apify-influencer-discovery
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the
@apify/mcpcpackage globally from the NPM registry. This is a well-known package from a reputable service provider. - [COMMAND_EXECUTION]: The skill executes local shell commands, including
mcpcfor fetching actor details andnodefor running the providedrun_actor.jsscript. These commands use local environment variables and user-provided parameters. - [DATA_EXPOSURE]: The skill manages authentication via an
APIFY_TOKENstored in a.envfile. This follows standard security practices for local development and secret management. - [INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection attack surface.
- Ingestion points: Data is ingested from external social media platforms (Instagram, Facebook, YouTube, TikTok) via Apify Actors.
- Boundary markers: No explicit delimiters or instructions are provided to the agent to ignore embedded instructions within the scraped social media content (e.g., bios, post text).
- Capability inventory: The skill can perform network operations (API calls to Apify) and write results to local CSV or JSON files via
writeFileSyncinrun_actor.js. - Sanitization: The script performs basic CSV escaping but does not sanitize content for potential malicious instructions targeted at the LLM.
Audit Metadata