apify-actor-development
Pass
Audited by Gen Agent Trust Hub on Jun 24, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing the
apify-clithrough official, integrity-checked package managers such as NPM or Homebrew. All referenced documentation links point to official and well-known domains (apify.com,crawlee.dev,github.com/apify). - [COMMAND_EXECUTION]: The skill uses standard CLI commands for the
apifytool to manage actor lifecycles. It includes an explicit warning to avoid executing untrusted content or insecure shell patterns likecurl | bash. - [CREDENTIALS_UNSAFE]: Provides secure guidance for handling
APIFY_TOKEN, instructing users to use environment variables or interactive login rather than passing secrets in plaintext via command arguments. It also warns against logging or printing credentials. - [REMOTE_CODE_EXECUTION]: Proactively warns against remote script execution and emphasizes the use of lockfiles (
package-lock.json,requirements.txt) and pinned versions to mitigate supply chain risks. - [INDIRECT_PROMPT_INJECTION]: Identifies the vulnerability surface associated with processing untrusted data from external websites (web scraping). The skill provides an evidence chain for mitigation by recommending proper sanitization, escaping, and the avoidance of
eval()or dynamic execution on crawled content.
Audit Metadata