apify-influencer-discovery
Pass
Audited by Gen Agent Trust Hub on Jun 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions direct the agent to execute Node.js scripts and the Apify CLI tool (@apify/mcpc) to perform data extraction tasks. These operations are within the expected scope of the skill's functionality.
- [PROMPT_INJECTION]: The skill processes user-generated content from external social media platforms, creating a potential surface for indirect prompt injection if malicious instructions are embedded in the retrieved data.
- Ingestion points: Data is retrieved from Apify datasets in
reference/scripts/run_actor.js. - Boundary markers: None identified in the data display or file-writing logic.
- Capability inventory: The script performs local file writes (
writeFileSync) and the agent can execute shell commands. - Sanitization: The script truncates long strings but does not sanitize content for potential injection patterns before display or processing.
- [SAFE]: The skill correctly uses environment variables for secret management and interacts only with verified domains belonging to a well-known service (apify.com).
Audit Metadata