apify-ecommerce
Pass
Audited by Gen Agent Trust Hub on Aug 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: The skill demonstrates robust security practices by implementing protection against CSV injection (also known as Formula Injection). The
csvCellfunction in the provided Node.js script sanitizes data starting with dangerous characters (=,+,@,-) before saving to CSV files. - [COMMAND_EXECUTION]: The skill executes a local Node.js script (
run_actor.js) to facilitate interaction with the Apify API. This execution is well-defined, uses standard built-in modules, and is restricted to the skill's intended operational scope. - [EXTERNAL_DOWNLOADS]: The script communicates exclusively with the official and well-known Apify API (
api.apify.com) to manage scraping tasks and retrieve data. This is an expected and legitimate use of external resources for this skill's purpose. - [CREDENTIALS_UNSAFE]: Secret management follows industry standards. The skill instructs users to store their
APIFY_TOKENin a local.envfile and leverages Node.js's native--env-filefeature for secure loading, avoiding hardcoded credentials.
Audit Metadata