apify-influencer-discovery

Pass

Audited by Gen Agent Trust Hub on Jun 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the @apify/mcpc package globally from the NPM registry. This is a well-known package from a reputable service provider.
  • [COMMAND_EXECUTION]: The skill executes local shell commands, including mcpc for fetching actor details and node for running the provided run_actor.js script. These commands use local environment variables and user-provided parameters.
  • [DATA_EXPOSURE]: The skill manages authentication via an APIFY_TOKEN stored in a .env file. This follows standard security practices for local development and secret management.
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection attack surface.
  • Ingestion points: Data is ingested from external social media platforms (Instagram, Facebook, YouTube, TikTok) via Apify Actors.
  • Boundary markers: No explicit delimiters or instructions are provided to the agent to ignore embedded instructions within the scraped social media content (e.g., bios, post text).
  • Capability inventory: The skill can perform network operations (API calls to Apify) and write results to local CSV or JSON files via writeFileSync in run_actor.js.
  • Sanitization: The script performs basic CSV escaping but does not sanitize content for potential malicious instructions targeted at the LLM.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 18, 2026, 07:44 PM