apify-ultimate-scraper
Pass
Audited by Gen Agent Trust Hub on Aug 2, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill interacts exclusively with the official Apify infrastructure (api.apify.com and mcp.apify.com) to perform its data extraction tasks.
- [SAFE]: The provided Node.js script
run_actor.jsincludes a sanitization functioncsvCellthat prepends an apostrophe to values starting with dangerous characters (=, +, @, -), effectively preventing CSV Formula Injection attacks in the exported results. - [SAFE]: The skill promotes secure credential management by instructing the agent to use a
.envfile for theAPIFY_TOKENrather than hardcoding it or passing it in plain text through unsafe channels. - [COMMAND_EXECUTION]: The skill defines specific shell commands to run the Apify CLI (mcpc) and its own local utility scripts. These commands are functionally necessary and do not contain patterns suggesting unauthorized system access or command injection vulnerabilities.
- [EXTERNAL_DOWNLOADS]: The skill facilitates the download of scraping results and the installation of the
@apify/mcpctool from the official NPM registry. These operations target well-known, established services and are consistent with the skill's primary purpose.
Audit Metadata