apify-debug-bundle
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources which could contain malicious instructions.
- Ingestion points:
references/implementation.mdutilizescurlto fetch Actor logs and dataset items from the Apify API. - Boundary markers: Absent; the content from logs and datasets is collected and stored in the debug bundle without specific delimiters or instructions to ignore embedded commands.
- Capability inventory: The skill uses
Bash(includingcurl,tar, andnpm) andGreptools. - Sanitization: While the skill redacts local
.envvalues usingsed, it does not perform sanitization or filtering on the logs or dataset items retrieved from the API. - [COMMAND_EXECUTION]: The skill uses shell commands via
Bashto perform diagnostic tasks. - Evidence:
references/implementation.mdcontains a script usingmkdir,curl,jq,npm list,sed,tar, andrmto gather and package system and API information. - [EXTERNAL_DOWNLOADS]: The skill fetches run metadata and logs from official Apify API domains.
- Evidence: Communicates with
api.apify.comto retrieve run details, logs, and platform health status. - [DATA_EXFILTRATION]: The skill aggregates environment details and local configuration into a single archive.
- Evidence:
apify-debug-bundle.shreads the local.envfile and system package information to include in a.tar.gzbundle intended for external sharing with support services. A redaction step is included to remove values from the environment file before inclusion.
Audit Metadata