apify-install-auth
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of official Apify libraries and tools (apify-client, apify, crawlee, apify-cli) from the public NPM registry. These represent standard dependencies for interacting with the well-known Apify automation service.
- [COMMAND_EXECUTION]: The instructions utilize standard package management (npm) and platform-specific CLI (apify) commands to configure the development environment. The skill's metadata further restricts the agent's capability by limiting Bash execution to these specific tools.
- [INDIRECT_PROMPT_INJECTION]: The skill incorporates user-supplied API tokens into shell commands and configuration files. This creates a surface where malicious input could potentially lead to command injection if not handled by the agent's internal safety mechanisms. * Ingestion points: API token input requested in SKILL.md and references/examples.md. * Boundary markers: The skill provides instructions for the agent but does not define explicit validation or delimiting rules for the token strings. * Capability inventory: Includes the Write tool and Bash execution for npm, npx, and apify tools. * Sanitization: No specific instructions for escaping or sanitizing user-provided strings before inclusion in commands or files are provided.
Audit Metadata