apify-actorization

Pass

Audited by Gen Agent Trust Hub on Aug 4, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the installation of the Apify CLI and SDKs from official registries and package managers.
  • Evidence: Commands such as brew install apify-cli, npm install apify, and pip install apify are referenced in SKILL.md and the language-specific references.
  • [EXTERNAL_DOWNLOADS]: References official documentation and templates from the Apify organization on GitHub.
  • Evidence: Links to github.com/apify/actor-templates and raw.githubusercontent.com/apify/actor-whitepaper are used for technical specifications.
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands for project initialization, environment setup, and deployment using the platform's CLI.
  • Evidence: apify init, apify run, and apify push commands in SKILL.md.
  • [PROMPT_INJECTION]: The skill facilitates the analysis of untrusted project source code and the generation of structured configuration files, creating a surface for indirect prompt injection.
  • Ingestion points: Local project files, entry points, and input/output definitions identified in SKILL.md.
  • Boundary markers: None explicitly defined to isolate untrusted project data from instructions.
  • Capability inventory: Includes shell command execution (apify CLI), file writing (.actor/actor.json), and remote deployment (apify push) across multiple files.
  • Sanitization: Relies on standard JSON parsing within the SDK and shell utilities like jq for input handling.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 4, 2026, 04:19 PM
Security Audit — agent-trust-hub — apify-actorization