apify-influencer-discovery
Pass
Audited by Gen Agent Trust Hub on Mar 5, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation recommends installing the
@apify/mcpcpackage. This is the official Model Context Protocol server for Apify, a well-known and trusted service provider, ensuring the dependency is legitimate. - [COMMAND_EXECUTION]: The workflow utilizes the
mcpcCLI tool and a provided Node.js script (run_actor.js) to interact with Apify Actors. These operations are scoped to the skill's primary function of data retrieval and analysis. - [CREDENTIALS_UNSAFE]: The skill requires an
APIFY_TOKENstored in a.envfile. The implementation uses Node.js's native environment file support to load this secret securely, avoiding hardcoded credentials in the source code. - [PROMPT_INJECTION]: The skill processes social media data fetched from external sources through the Apify platform.
- Ingestion points: Data items are retrieved from the Apify dataset API (
api.apify.com) inreference/scripts/run_actor.js. - Boundary markers: The output does not use explicit boundary markers for the data presented to the agent, but it is structured by the script's logging functions.
- Capability inventory: The
run_actor.jsscript has file-writing capabilities (writeFileSync) and the agent is instructed to execute local scripts and CLI tools. - Sanitization: The script performs sanitization by truncating long text fields to 100-200 characters and applying standard CSV escaping to all output values, reducing the risk of downstream instruction injection or formatting exploits.
Audit Metadata