apify-content-analytics

Pass

Audited by Gen Agent Trust Hub on Sep 6, 2026

Risk Level: SAFE
Full Analysis
  • [CREDENTIALS_UNSAFE]: The skill requires an APIFY_TOKEN stored in a .env file for authentication with the Apify API. This follows standard security best practices for local secret management rather than hardcoding credentials.
  • [EXTERNAL_DOWNLOADS]: The documentation instructs the user to install the @apify/mcpc package from the official npm registry, which is a well-known tool for interacting with the Apify platform.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources (social media platforms) via Apify Actors, which could contain malicious instructions designed to influence the agent's summary.
  • Ingestion points: Data is fetched in reference/scripts/run_actor.js through the downloadResults and displayQuickAnswer functions.
  • Boundary markers: None explicitly implemented; the scraped data is printed directly to the console or saved to a file.
  • Capability inventory: The skill has the capability to write files to the disk (writeFileSync) and make network requests to Apify's API (fetch).
  • Sanitization: The script includes a csvCell function that specifically prevents CSV formula injection by prefixing suspicious characters with a single quote. It also truncates long strings to manage context window size.
  • [COMMAND_EXECUTION]: The skill relies on the agent executing shell commands to run the local Node.js utility and the mcpc CLI tool.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 6, 2026, 08:02 AM
Security Audit — agent-trust-hub — apify-content-analytics