apify-reference-architecture
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides reference architectures and skeleton code for building scraping applications. No malicious code, obfuscation, or injection attempts were found across the instructions or reference files.
- [CREDENTIALS_SAFE]: The skill demonstrates secure secret management. It explicitly instructs the user to never hardcode API tokens and instead use environment variables (e.g.,
APIFY_TOKEN), which is a standard security best practice. - [EXTERNAL_DOWNLOADS]: The dependencies and tools mentioned in the documentation—including
apify-cli,apify,crawlee,apify-client, andzod—are well-known, reputable packages and official tools within the Node.js and web scraping ecosystems. - [INDIRECT_PROMPT_INJECTION]: While the architecture describes a system that ingests external web data (a potential surface for indirect prompt injection), the skill provides appropriate mitigation strategies such as typed input validation via
zodand isolation of service layers to minimize risks.
Audit Metadata