apify-google-maps
Warn
Audited by Gen Agent Trust Hub on Apr 8, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFEDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The scripts
apify_leads_sheet.pyandenrich_leads.pyaccess a sensitive file namedservice_account.jsonto authenticate with Google Cloud services. This file typically contains private keys that grant access to the user's Google Sheets data. - [DATA_EXFILTRATION]: The skill performs network requests to Apify and Google APIs to transmit search queries and receive scraped business details. These operations are essential for the skill's functionality and target well-known, trusted services.
- [PROMPT_INJECTION]: The skill processes untrusted data scraped from external websites and Google Maps listings, which presents an indirect prompt injection surface. This data is written to Google Sheets without extensive sanitization.
- Ingestion points: Scraped business data and contact information are retrieved from Apify datasets in
apify_leads_sheet.pyandenrich_leads.py. - Boundary markers: No explicit delimiters or instructions are used to separate scraped content from the processing logic.
- Capability inventory: The skill can execute remote scraping tasks via Apify and perform write operations to external spreadsheets.
- Sanitization: Apart from basic URL parsing in
apify_leads_sheet.py, no significant sanitization of the scraped text content is performed before it is stored.
Audit Metadata