apify-security-basics
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides instructions for processing external data from Apify webhooks, which could contain malicious instructions if the source is compromised.
- Ingestion points: Webhook payloads handled in references/implementation.md and references/examples.md.
- Boundary markers: The skill suggests using a shared secret for webhook verification to ensure source authenticity.
- Capability inventory: Includes data storage operations via dataset.pushData.
- Sanitization: Includes a sanitizeForDataset function to redact sensitive fields before storage.
- [SAFE]: The skill uses curl to interact with api.apify.com, which is a well-known service, for the purpose of token verification.
Audit Metadata