apify-content-analytics
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFE
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill requires an
APIFY_TOKENstored in a.envfile for authentication with the Apify API. This follows standard security best practices for local secret management rather than hardcoding credentials. - [EXTERNAL_DOWNLOADS]: The documentation instructs the user to install the
@apify/mcpcpackage from the official npm registry, which is a well-known tool for interacting with the Apify platform. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources (social media platforms) via Apify Actors, which could contain malicious instructions designed to influence the agent's summary.
- Ingestion points: Data is fetched in
reference/scripts/run_actor.jsthrough thedownloadResultsanddisplayQuickAnswerfunctions. - Boundary markers: None explicitly implemented; the scraped data is printed directly to the console or saved to a file.
- Capability inventory: The skill has the capability to write files to the disk (
writeFileSync) and make network requests to Apify's API (fetch). - Sanitization: The script includes a
csvCellfunction that specifically prevents CSV formula injection by prefixing suspicious characters with a single quote. It also truncates long strings to manage context window size. - [COMMAND_EXECUTION]: The skill relies on the agent executing shell commands to run the local Node.js utility and the
mcpcCLI tool.
Audit Metadata