apify-trend-analysis
Warn
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFEREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION] (MEDIUM): The skill constructs and executes shell commands in Step 2 and Step 4. Specifically, it uses variables like
ACTOR_IDandJSON_INPUTinside shell strings. If these variables contain malicious shell metacharacters (e.g.,;,&&,|), it could lead to arbitrary command execution. - [EXTERNAL_DOWNLOADS] (LOW): The skill requires the user to install a global NPM package
@apify/mcpc. While Apify is a reputable source, global installations of third-party tools should be reviewed for least-privilege compliance. - [CREDENTIALS_UNSAFE] (LOW): The workflow involves reading an
APIFY_TOKENfrom a.envfile using shell utilities (grep,xargs). While the token is not hardcoded, the method of exporting it to the environment for themcpccommand increases the visibility of the secret in process listings. - [REMOTE_CODE_EXECUTION] (MEDIUM): Step 4 executes a script located at
${CLAUDE_PLUGIN_ROOT}/reference/scripts/run_actor.js. Since the source code for this script is not bundled with the skill, its behavior and security posture cannot be verified during this audit. - [DATA_EXPOSURE] (LOW): The skill facilitates the extraction of data from various social platforms. While intended for trend analysis, users should ensure that the Actors used do not inadvertently collect or exfiltrate private or sensitive information beyond the scope of public trends.
Audit Metadata