apify-market-research
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
@apify/mcpcCLI tool via npm. This is an official utility provided by Apify, which is a well-known and trusted web scraping and automation platform.\n- [COMMAND_EXECUTION]: The skill involves executing shell commands to load environment variables from a.envfile and to run both the external Apify CLI and a provided local Node.js script (run_actor.js). These operations are standard for the skill's documented purpose of API interaction.\n- [INDIRECT_PROMPT_INJECTION]:\n - Ingestion points: Data is ingested from various external platforms (social media, travel sites, search engines) through the execution of Apify actors, which is then processed by the agent in Step 5.\n
- Boundary markers: No explicit delimiters are provided in the prompt to separate external research data from agent instructions.\n
- Capability inventory: The skill has file system write capabilities via
writeFileSyncinrun_actor.jsto save research results, and it uses command execution to perform its tasks.\n - Sanitization: The
run_actor.jsscript proactively implements sanitization to prevent CSV formula injection by prepending a single quote to cells starting with sensitive characters (=,+,@,-).
Audit Metadata