apify-actorization
Pass
Audited by Gen Agent Trust Hub on Aug 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the installation of the Apify CLI and SDKs from official registries and package managers.
- Evidence: Commands such as
brew install apify-cli,npm install apify, andpip install apifyare referenced inSKILL.mdand the language-specific references. - [EXTERNAL_DOWNLOADS]: References official documentation and templates from the Apify organization on GitHub.
- Evidence: Links to
github.com/apify/actor-templatesandraw.githubusercontent.com/apify/actor-whitepaperare used for technical specifications. - [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands for project initialization, environment setup, and deployment using the platform's CLI.
- Evidence:
apify init,apify run, andapify pushcommands inSKILL.md. - [PROMPT_INJECTION]: The skill facilitates the analysis of untrusted project source code and the generation of structured configuration files, creating a surface for indirect prompt injection.
- Ingestion points: Local project files, entry points, and input/output definitions identified in
SKILL.md. - Boundary markers: None explicitly defined to isolate untrusted project data from instructions.
- Capability inventory: Includes shell command execution (
apifyCLI), file writing (.actor/actor.json), and remote deployment (apify push) across multiple files. - Sanitization: Relies on standard JSON parsing within the SDK and shell utilities like
jqfor input handling.
Audit Metadata