apify-influencer-discovery-v2

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The runtime workflow calls Apify APIs to fetch actor schemas and dataset items (e.g., mcpc ... fetch-actor-details and run_actor.js downloads https://api.apify.com/v2/datasets/${datasetId}/items), and those dataset items can contain outsider-authored free text (scraped bios/comments) that is then printed/summarized into the agent’s LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The included runtime script (reference/scripts/run_actor.js) makes direct API calls that start and poll Apify actors—e.g., POST to https://api.apify.com/v2/acts/{actorId}/runs?token=... and later GETs to https://api.apify.com/v2/actor-runs/{runId} and dataset endpoints—which executes remote code on Apify and is a required runtime dependency (requires APIFY_TOKEN).