apify-influencer-discovery
Pass
Audited by Gen Agent Trust Hub on Jul 14, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill instructions and scripts reference a .env file to manage the APIFY_TOKEN. This is a standard and safe practice for secret management in development workflows.\n- [EXTERNAL_DOWNLOADS]: The skill connects to api.apify.com to download actor results. Apify is a well-known service for web scraping and automation, and these downloads are considered safe and routine for the skill's purpose.\n- [COMMAND_EXECUTION]: The skill executes the mcpc CLI tool and a local Node.js script (run_actor.js) to interact with the Apify platform.\n- [PROMPT_INJECTION]: The skill ingests influencer data from social media platforms, which identifies a surface for indirect prompt injection.\n
- Ingestion points: Influencer metrics and bio data fetched from social media platforms via Apify Actors in run_actor.js.\n
- Boundary markers: Absent from the summarization instructions in SKILL.md.\n
- Capability inventory: The skill possesses file writing capabilities and network access to the Apify API.\n
- Sanitization: The run_actor.js script truncates long string values to 200 characters and applies standard CSV escaping to output data.
Audit Metadata