apify-ecommerce

Pass

Audited by Gen Agent Trust Hub on Oct 23, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill initiates network requests to the Apify API (api.apify.com) to manage and execute scraping actors. This is the intended behavior of the skill and targets a well-known technology service.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data scraped from various e-commerce websites, which could contain malicious instructions.
  • Ingestion points: The skill fetches JSON datasets from Apify which contain product details and reviews from the web.
  • Boundary markers: No explicit prompt delimiters are provided to the model when processing this data, relying on the model's inherent safety guardrails.
  • Capability inventory: The script can write data to user-specified local files and display information in the terminal.
  • Sanitization: The script includes specific logic to sanitize data for CSV export by prepending a single quote to any cell starting with characters that could trigger formula execution (e.g., =, +, -, @).
  • [COMMAND_EXECUTION]: The instructions involve executing a local Node.js script that uses the --env-file feature to load an API token from a dedicated environment file (~/.claude/.env). This is a recommended practice for secure credential management in local development environments.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 23, 2026, 02:28 PM