apify-ultimate-scraper
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a Node.js script (
run_actor.js) and themcpcCLI tool to interact with the Apify platform. All shell commands documented inSKILL.mduse hardcoded logic or carefully delimited placeholders for parameters likeACTOR_IDandJSON_INPUT. - [DATA_EXPOSURE]: The skill requires an
APIFY_TOKENstored in a.envfile. This is a standard and safe practice for secret management in development environments. The script correctly retrieves this token from the environment rather than hardcoding it. - [EXTERNAL_DOWNLOADS]: The skill references official Apify tools and services (e.g.,
mcp.apify.com,api.apify.com, and the@apify/mcpcNPM package). These are well-known services associated with the skill's primary purpose and do not represent a security risk. - [SAFE]: The CSV generation logic in
run_actor.jsincludes a protection against CSV injection by prefixing suspicious characters (=,+,@,-) with a single quote.
Audit Metadata