apify-market-research
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using the
mcpcCLI tool and a provided Node.js script,run_actor.js, to interact with the Apify platform. - [EXTERNAL_DOWNLOADS]: The instructions recommend installing the
@apify/mcpcpackage from the official npm registry, which is the standard tool for integrating with Apify's Model Context Protocol (MCP) server. - [INDIRECT_PROMPT_INJECTION]: The skill processes scraped market data from various social and business platforms, which is untrusted external content.
- Ingestion points: The
run_actor.jsscript fetches dataset items from Apify's API, which are then either saved to files or displayed in the chat. - Boundary markers: Not explicitly present in the summarization instructions.
- Capability inventory: The skill possesses file writing capabilities (
writeFileSync), network access toapi.apify.com, and command execution via the agent shell. - Sanitization: The
run_actor.jsscript includes acsvCellfunction that specifically escapes characters (=,+,@,-) known to trigger formula execution in spreadsheet software, mitigating CSV injection risks.
Audit Metadata