apify-prod-checklist
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes shell commands including
apify push,apify builds ls, andapify actors callto manage Actor deployments and smoke-test results on the Apify platform. - [EXTERNAL_DOWNLOADS]: The skill references the
apify-clientNode.js library and interacts with the official Apify API (api.apify.com) to facilitate monitoring, webhooks, and rollback operations. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to read and process local project configuration files to confirm production readiness, which presents a surface for indirect instructions if those files are modified by an untrusted source. Ingestion points:
.actor/actor.json,INPUT_SCHEMA.json, andDockerfile. Boundary markers: Absent. Capability inventory:Bash(apify:*),Bash(curl:*),Bash(npm:*). Sanitization: Absent.
Audit Metadata