apify-actor-development

Pass

Audited by Gen Agent Trust Hub on Jun 24, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill recommends installing the apify-cli through official, integrity-checked package managers such as NPM or Homebrew. All referenced documentation links point to official and well-known domains (apify.com, crawlee.dev, github.com/apify).
  • [COMMAND_EXECUTION]: The skill uses standard CLI commands for the apify tool to manage actor lifecycles. It includes an explicit warning to avoid executing untrusted content or insecure shell patterns like curl | bash.
  • [CREDENTIALS_UNSAFE]: Provides secure guidance for handling APIFY_TOKEN, instructing users to use environment variables or interactive login rather than passing secrets in plaintext via command arguments. It also warns against logging or printing credentials.
  • [REMOTE_CODE_EXECUTION]: Proactively warns against remote script execution and emphasizes the use of lockfiles (package-lock.json, requirements.txt) and pinned versions to mitigate supply chain risks.
  • [INDIRECT_PROMPT_INJECTION]: Identifies the vulnerability surface associated with processing untrusted data from external websites (web scraping). The skill provides an evidence chain for mitigation by recommending proper sanitization, escaping, and the avoidance of eval() or dynamic execution on crawled content.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 24, 2026, 08:39 AM
Security Audit — agent-trust-hub — apify-actor-development