ad-angle-miner

Pass

Audited by Gen Agent Trust Hub on Oct 7, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill interacts with Apify's official API (api.apify.com) to initiate and retrieve data from scraping actors such as web_wanderer/amazon-reviews-extractor and trudax/reddit-scraper-lite. These interactions are central to the skill's stated purpose of market research.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from multiple external sources, creating a potential surface for indirect prompt injection.
  • Ingestion points: Data is ingested from Amazon reviews, Reddit posts/comments, Twitter content, and general web search results across files like SKILL.md (Phase 1).
  • Boundary markers: No explicit XML-style tags or structural delimiters are defined in the instructions to isolate scraped content from the agent's logic during the extraction phase.
  • Capability inventory: The skill possesses capabilities for network operations (Apify API), web searching, and writing the final analysis to local markdown files (angle-bank-[YYYY-MM-DD].md).
  • Sanitization: There are no instructions for sanitizing or filtering instructions that might be embedded within the scraped reviews or social media posts.
  • [DATA_EXPOSURE]: The skill requires the APIFY_API_TOKEN environment variable. The instructions suggest passing this token as a query parameter in URLs (?token=$APIFY_API_TOKEN). While this is a standard authentication method for the Apify platform, it can expose the token in network logs or proxy histories.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 7, 2026, 09:00 PM