apify-trend-analysis

Pass

Audited by Gen Agent Trust Hub on Oct 13, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructions direct the user to install the @apify/mcpc package, which is a well-known CLI tool for interacting with Apify services.
  • [COMMAND_EXECUTION]: The workflow involves running the mcpc CLI and a local JavaScript utility (run_actor.js) to automate actor execution and data retrieval.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external trend data from platforms like Instagram, TikTok, and Google Trends via Apify Actors, which is a standard surface for indirect prompt injection given the skill's purpose.
  • Ingestion points: Untrusted trend data enters the agent's context through the Apify dataset API in run_actor.js (specifically in the downloadResults and displayQuickAnswer functions).
  • Boundary markers: The skill does not currently use specific delimiters or instructions to ignore potential commands embedded within the fetched social media content.
  • Capability inventory: The run_actor.js script includes the ability to write extracted data to the local file system using fs.writeFileSync and to output content to the console.
  • Sanitization: The script implements standard CSV formatting and string truncation for display purposes, which provides a basic layer of data handling.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 13, 2026, 07:20 AM