apify-google-maps

Warn

Audited by Gen Agent Trust Hub on Apr 8, 2026

Risk Level: MEDIUMCREDENTIALS_UNSAFEDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [CREDENTIALS_UNSAFE]: The scripts apify_leads_sheet.py and enrich_leads.py access a sensitive file named service_account.json to authenticate with Google Cloud services. This file typically contains private keys that grant access to the user's Google Sheets data.
  • [DATA_EXFILTRATION]: The skill performs network requests to Apify and Google APIs to transmit search queries and receive scraped business details. These operations are essential for the skill's functionality and target well-known, trusted services.
  • [PROMPT_INJECTION]: The skill processes untrusted data scraped from external websites and Google Maps listings, which presents an indirect prompt injection surface. This data is written to Google Sheets without extensive sanitization.
  • Ingestion points: Scraped business data and contact information are retrieved from Apify datasets in apify_leads_sheet.py and enrich_leads.py.
  • Boundary markers: No explicit delimiters or instructions are used to separate scraped content from the processing logic.
  • Capability inventory: The skill can execute remote scraping tasks via Apify and perform write operations to external spreadsheets.
  • Sanitization: Apart from basic URL parsing in apify_leads_sheet.py, no significant sanitization of the scraped text content is performed before it is stored.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Apr 8, 2026, 08:23 AM
Security Audit — agent-trust-hub — apify-google-maps