apify-lead-generation
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions to run a local utility script (
run_actor.js) and themcpcCLI tool. These tools are used for legitimate service interaction with the Apify platform to discover and run scrapers. - [CREDENTIALS_SAFE]: The instructions and script follow best practices by recommending the use of a
.envfile for storing theAPIFY_TOKEN. The script loads this token from environment variables rather than hardcoding it. - [EXTERNAL_DOWNLOADS]: The skill references the
@apify/mcpcpackage, which is the official CLI tool provided by Apify, a well-known service for web scraping and automation. - [DATA_EXPOSURE]: The provided Node.js script includes a
csvCellfunction specifically designed to mitigate CSV injection (Formula Injection) by sanitizing data before exporting it to spreadsheet formats. This demonstrates a security-conscious implementation for handling potentially untrusted data from social media platforms. - [INDIRECT_PROMPT_INJECTION]: While the skill processes data from external sources (Instagram, TikTok, Google Maps) which could contain malicious content, it does not dynamically execute instructions from this data. It provides summarized results or raw exports, which is the intended functionality of a lead generation tool.
Audit Metadata