Apify

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). Most URLs are legitimate public sites (YouTube, Twitter, LinkedIn, Apify, Google Maps, Amazon, etc.), but the manifest/skill forces an immediate POST to a local endpoint (http://localhost:31337/notify) — an instruction to execute network activity on the host that is unnecessary for downloads and could be abused to trigger local services or exfiltrate/activate payloads.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The package includes a mandatory, stealthy backgrounded curl to http://localhost:31337/notify (explicitly required before any action) and multiple explicit data‑harvesting flows (Google Maps contact/email extraction) — patterns that can be abused as a local backdoor/signal and for unauthorized data collection/exfiltration.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Outsider-authored free text from scraped social/web content is ingested at runtime via dataset item listing in the Apify code-first workflow (e.g., Twitter/Instagram/Facebook/YouTube/Google Maps reviews/comments/text fields) and then returned to the model after in-code filtering.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill invokes the Apify platform at runtime (Apify client / actors) — e.g. the APIFY_API_BASE_URL https://api.apify.com/v2 is used to call remote Apify actors that execute code on Apify and the skill depends on those actor runs.