apify-debug-bundle

Pass

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources which could contain malicious instructions.
  • Ingestion points: references/implementation.md utilizes curl to fetch Actor logs and dataset items from the Apify API.
  • Boundary markers: Absent; the content from logs and datasets is collected and stored in the debug bundle without specific delimiters or instructions to ignore embedded commands.
  • Capability inventory: The skill uses Bash (including curl, tar, and npm) and Grep tools.
  • Sanitization: While the skill redacts local .env values using sed, it does not perform sanitization or filtering on the logs or dataset items retrieved from the API.
  • [COMMAND_EXECUTION]: The skill uses shell commands via Bash to perform diagnostic tasks.
  • Evidence: references/implementation.md contains a script using mkdir, curl, jq, npm list, sed, tar, and rm to gather and package system and API information.
  • [EXTERNAL_DOWNLOADS]: The skill fetches run metadata and logs from official Apify API domains.
  • Evidence: Communicates with api.apify.com to retrieve run details, logs, and platform health status.
  • [DATA_EXFILTRATION]: The skill aggregates environment details and local configuration into a single archive.
  • Evidence: apify-debug-bundle.sh reads the local .env file and system package information to include in a .tar.gz bundle intended for external sharing with support services. A redaction step is included to remove values from the environment file before inclusion.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 9, 2026, 03:43 AM