apify-influencer-discovery

Pass

Audited by Gen Agent Trust Hub on Mar 5, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill documentation recommends installing the @apify/mcpc package. This is the official Model Context Protocol server for Apify, a well-known and trusted service provider, ensuring the dependency is legitimate.
  • [COMMAND_EXECUTION]: The workflow utilizes the mcpc CLI tool and a provided Node.js script (run_actor.js) to interact with Apify Actors. These operations are scoped to the skill's primary function of data retrieval and analysis.
  • [CREDENTIALS_UNSAFE]: The skill requires an APIFY_TOKEN stored in a .env file. The implementation uses Node.js's native environment file support to load this secret securely, avoiding hardcoded credentials in the source code.
  • [PROMPT_INJECTION]: The skill processes social media data fetched from external sources through the Apify platform.
  • Ingestion points: Data items are retrieved from the Apify dataset API (api.apify.com) in reference/scripts/run_actor.js.
  • Boundary markers: The output does not use explicit boundary markers for the data presented to the agent, but it is structured by the script's logging functions.
  • Capability inventory: The run_actor.js script has file-writing capabilities (writeFileSync) and the agent is instructed to execute local scripts and CLI tools.
  • Sanitization: The script performs sanitization by truncating long text fields to 100-200 characters and applying standard CSV escaping to all output values, reducing the risk of downstream instruction injection or formatting exploits.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 5, 2026, 08:44 AM