Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Full OpenAPI spec: [openapi.json](openapi.json)
Security audit
Apify
Security checks for vulnerabilities and agentic risk
Overview
This Apify skill mostly matches its scraping purpose, but it ships a full Apify API spec that exposes account-changing capabilities far beyond running scrapers.
Install only if you are comfortable giving an agent access to an Apify token and understand that targets, inputs, logs, screenshots, and scraped data may be processed or stored by Apify. Prefer a restricted token or a narrowed version of the skill that exposes only actor run/status/result endpoints, and avoid letting it manage webhooks, schedules, account limits, actors, tasks, or storage unless you explicitly need those admin actions.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (53)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Full OpenAPI spec: [openapi.json](openapi.json)
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill metadata says it is for running Apify Actors and retrieving scraping results, but the OpenAPI spec exposes broad account-management functionality including actor creation/deletion, storage mutation, billing/limits, webhooks, and schedules. This mismatch violates least privilege and can let an agent with a scraping-oriented trust envelope perform unrelated high-impact actions on the user's Apify account.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Arbitrary webhook creation, update, test, and dispatch inspection enables configuring outbound HTTP notifications to attacker-controlled destinations. In an agent context, this can be abused for covert exfiltration of run metadata, outputs, or tokens interpolated into webhook templates.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill includes user-private data, billing usage, and account limits endpoints that are unrelated to scraping or result retrieval. An agent induced to use these endpoints could disclose sensitive account information or modify spend/retention settings, expanding harm beyond the intended workflow.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill description is broad enough to activate on many generic web-related requests, which can cause the agent to route users into a third-party scraping workflow unnecessarily. In this context, overbroad triggering is risky because the skill performs network actions and can send user-supplied targets and queries to Apify, increasing the chance of unintended data disclosure or unreviewed scraping behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs sending URLs, queries, and other user-provided scraping inputs to Apify but does not warn that these inputs will be transmitted to and processed by an external service. That omission is dangerous because users may provide sensitive internal URLs, account-specific targets, or proprietary search terms without realizing they are leaving the local environment.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
You can also get the Actor's per-build OpenAPI spec (no auth required):
bash curl -s "https://api.apify.com/v2/acts/apify~web-scraper/builds/default/openapi.json"3. Run an Actor (async — recommended for most cases)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
This endpoint starts an Apify Actor with user-supplied JSON input, transmitting targets and crawl parameters to a third-party service and causing remote execution of web automation. In this skill's context, that is the core function, but it is also the main security boundary: sensitive URLs, queries, tokens embedded in targets, or instructions affecting external sites could be sent and processed without adequate warning or confirmation.
- Content
Start the Actor and get the run object back immediately:
bash curl -s -X POST "https://api.apify.com/v2/acts/apify~web-scraper/runs" \ -H "Authorization: Bearer $APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"startUrls":[{"url":"https://example.com"}],"maxPagesPerCrawl":10}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 87% confidence
- Finding
Retrieving dataset items from Apify pulls back data that may include scraped content, personal data, or proprietary information collected during the run. The danger is not the GET itself but that the skill normalizes third-party storage and retrieval of potentially sensitive scraped results without a clear warning or minimization guidance.
- Content
Dataset items (most common — structured scraped data):
bash curl -s "https://api.apify.com/v2/datasets/DATASET_ID/items?clean=true&limit=100" \ -H "Authorization: Bearer $APIFY_TOKEN"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 87% confidence
- Finding
This shortcut endpoint retrieves a run's dataset items directly, which still means the results were processed and stored by Apify and may contain sensitive scraped data. In context, the lack of prominent disclosure and minimization guidance makes this a real privacy and confidentiality concern.
- Content
Or directly from the run (shortcut — same parameters):
bash curl -s "https://api.apify.com/v2/actor-runs/RUN_ID/dataset/items?clean=true&limit=100" \ -H "Authorization: Bearer $APIFY_TOKEN"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 89% confidence
- Finding
Key-value store retrieval can expose stored HTML, screenshots, or output records that may contain sensitive page content, credentials in rendered views, or proprietary material. Because the skill encourages this retrieval without cautioning about third-party storage and sensitivity of artifacts, it creates a meaningful data-exposure risk.
- Content
Key-value store record (screenshots, HTML, OUTPUT):
bash curl -s "https://api.apify.com/v2/key-value-stores/STORE_ID/records/OUTPUT" \ -H "Authorization: Bearer $APIFY_TOKEN"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 89% confidence
- Finding
Key-value store retrieval can expose stored HTML, screenshots, or output records that may contain sensitive page content, credentials in rendered views, or proprietary material. Because the skill encourages this retrieval without cautioning about third-party storage and sensitivity of artifacts, it creates a meaningful data-exposure risk.
- Content
Key-value store record (screenshots, HTML, OUTPUT):
bash curl -s "https://api.apify.com/v2/key-value-stores/STORE_ID/records/OUTPUT" \ -H "Authorization: Bearer $APIFY_TOKEN"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 82% confidence
- Finding
Run logs can include target URLs, actor inputs, error traces, and other operational details that may reveal sensitive information. Exposing or encouraging log retrieval without warning increases the risk of leaking secrets or private targets through a third-party logging channel.
- Content
Run log:
bash curl -s "https://api.apify.com/v2/logs/RUN_ID" \ -H "Authorization: Bearer $APIFY_TOKEN"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 94% confidence
- Finding
The synchronous run endpoint sends user-provided crawl targets and parameters to Apify and immediately returns collected results, making it easy to exfiltrate sensitive targets or scrape data through a third-party service with little friction. The convenience of the one-call pattern increases the likelihood of accidental misuse because it compresses consent, execution, and retrieval into a single step.
- Content
For Actors that finish within 300 seconds, get dataset items in one call:
bash curl -s -X POST "https://api.apify.com/v2/acts/apify~web-scraper/run-sync-get-dataset-items?timeout=120" \ -H "Authorization: Bearer $APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"startUrls":[{"url":"https://example.com"}],"maxPagesPerCrawl":5}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 94% confidence
- Finding
The 'Scrape a website' recipe is a ready-to-run example that directly transmits a target URL to Apify for remote crawling. In context, this lowers the barrier to externalizing user-provided web targets and can lead to unintended scraping of sensitive or non-public resources if activation or consent is weak.
- Content
Scrape a website
bash curl -s -X POST "https://api.apify.com/v2/acts/apify~web-scraper/run-sync-get-dataset-items?timeout=120" \ -H "Authorization: Bearer $APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"startUrls":[{"url":"https://example.com"}],"maxPagesPerCrawl":20}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
The Google search scraper recipe sends user queries to a third-party Actor, which can expose sensitive research topics, internal project names, or investigative intent. Although such transmission is part of the service, the skill does not warn users that their search terms will be processed externally.
- Content
Google search
bash curl -s -X POST "https://api.apify.com/v2/acts/apify~google-search-scraper/run-sync-get-dataset-items?timeout=120" \ -H "Authorization: Bearer $APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"queries":"site:example.com openai","maxPagesPerQuery":1}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
This async workflow starts a potentially large crawl (
maxPagesPerCrawl: 500) on a third-party platform using user-supplied targets, increasing the blast radius of accidental or unauthorized collection. The higher crawl limit makes the context more dangerous because more data may be transmitted, stored, and scraped before a user realizes the scope.- Content
bash # 1. Start RUN=$(curl -s -X POST "https://api.apify.com/v2/acts/apify~web-scraper/runs?waitForFinish=60" \ -H "Authorization: Bearer $APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"startUrls":[{"url":"https://example.com"}],"maxPagesPerCrawl":500}')
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 87% confidence
- Finding
Fetching the final dataset from a large async crawl can return significant amounts of potentially sensitive scraped data that were stored on Apify. Without warning or minimization controls, this encourages broad third-party collection and retrieval of data that may not be appropriate to externalize.
- Content
done
3. Fetch results
curl -s "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?clean=true"
-H "Authorization: Bearer $APIFY_TOKEN"text
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md "name": "Apache 2.0", "url": "https://www.apache.org/licenses/LICENSE-2.0.html" }, "description": "\nThe Apify API (version 2) provides programmatic access to the [Apify\nplatform](https://docs.apify.com). The API is organized\naround [RESTful](https://en.wikipedia.org/wiki/Representational_state_transfer)\nHTTP endpoints.\n\nYou can download the complete OpenAPI schema of Apify API in the [YAML](http://docs.apify.com/api/openapi.yaml) or [JSON](http://docs.apify.com/api/openapi.json) formats. The source code is also available on [GitHub](https://github.com/apify/apify-docs/tree/master/apify-api/openapi).\n\nAll requests and responses (including errors) are encoded in\n[JSON](http://www.json.org/) format with UTF-8 encoding,\nwith a few exceptions that are explicitly described in the reference.\n\n- To access the API using [Node.js](https://nodejs.org/en/), we recommend the [`apify-client`](https://docs.apify.com/api/client/js) [NPM\npackage](https://www.npmjs.com/package/apify-client).\n- To access the API using [Python](https://www.python.org/), we recommend the [`apify-client`](https://docs.apify.com/api/client/python) [PyPI\npackage](https://pypi.org/project/apify-client/).\n\nThe clients' functions correspond to the API endpoints and have the same\nparameters. This simplifies development of apps that depend on the Apify\nplatform.\n\n:::note Important Request Details\n\n- `Content-Type` header: For requests with a JSON body, you must include the `Content-Type: application/json` header.\n\n- Method override: You can override the HTTP method using the `method` query parameter. This is useful for clients that can only send `GET` requests. For example, to call a `POST` endpoint, append `?method=POST` to the URL of your `GET` request.\n\n:::\n\n## Authentication\n<span id=\"/introduction/authentication\"></span>\n\nYou can find your API token on the\n[Integrations](https://console.apify.com/account#/integrations) page in the\nApify Console.\n\nTo use y ...[truncated 27 chars]
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md "name": "Apache 2.0", "url": "https://www.apache.org/licenses/LICENSE-2.0.html" }, "description": "\nThe Apify API (version 2) provides programmatic access to the [Apify\nplatform](https://docs.apify.com). The API is organized\naround [RESTful](https://en.wikipedia.org/wiki/Representational_state_transfer)\nHTTP endpoints.\n\nYou can download the complete OpenAPI schema of Apify API in the [YAML](http://docs.apify.com/api/openapi.yaml) or [JSON](http://docs.apify.com/api/openapi.json) formats. The source code is also available on [GitHub](https://github.com/apify/apify-docs/tree/master/apify-api/openapi).\n\nAll requests and responses (including errors) are encoded in\n[JSON](http://www.json.org/) format with UTF-8 encoding,\nwith a few exceptions that are explicitly described in the reference.\n\n- To access the API using [Node.js](https://nodejs.org/en/), we recommend the [`apify-client`](https://docs.apify.com/api/client/js) [NPM\npackage](https://www.npmjs.com/package/apify-client).\n- To access the API using [Python](https://www.python.org/), we recommend the [`apify-client`](https://docs.apify.com/api/client/python) [PyPI\npackage](https://pypi.org/project/apify-client/).\n\nThe clients' functions correspond to the API endpoints and have the same\nparameters. This simplifies development of apps that depend on the Apify\nplatform.\n\n:::note Important Request Details\n\n- `Content-Type` header: For requests with a JSON body, you must include the `Content-Type: application/json` header.\n\n- Method override: You can override the HTTP method using the `method` query parameter. This is useful for clients that can only send `GET` requests. For example, to call a `POST` endpoint, append `?method=POST` to the URL of your `GET` request.\n\n:::\n\n## Authentication\n<span id=\"/introduction/authentication\"></span>\n\nYou can find your API token on the\n[Integrations](https://console.apify.com/account#/integrations) page in the\nApify Console.\n\nTo use y ...[truncated 27 chars]
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md "name": "Apache 2.0", "url": "https://www.apache.org/licenses/LICENSE-2.0.html" }, "description": "\nThe Apify API (version 2) provides programmatic access to the [Apify\nplatform](https://docs.apify.com). The API is organized\naround [RESTful](https://en.wikipedia.org/wiki/Representational_state_transfer)\nHTTP endpoints.\n\nYou can download the complete OpenAPI schema of Apify API in the [YAML](http://docs.apify.com/api/openapi.yaml) or [JSON](http://docs.apify.com/api/openapi.json) formats. The source code is also available on [GitHub](https://github.com/apify/apify-docs/tree/master/apify-api/openapi).\n\nAll requests and responses (including errors) are encoded in\n[JSON](http://www.json.org/) format with UTF-8 encoding,\nwith a few exceptions that are explicitly described in the reference.\n\n- To access the API using [Node.js](https://nodejs.org/en/), we recommend the [`apify-client`](https://docs.apify.com/api/client/js) [NPM\npackage](https://www.npmjs.com/package/apify-client).\n- To access the API using [Python](https://www.python.org/), we recommend the [`apify-client`](https://docs.apify.com/api/client/python) [PyPI\npackage](https://pypi.org/project/apify-client/).\n\nThe clients' functions correspond to the API endpoints and have the same\nparameters. This simplifies development of apps that depend on the Apify\nplatform.\n\n:::note Important Request Details\n\n- `Content-Type` header: For requests with a JSON body, you must include the `Content-Type: application/json` header.\n\n- Method override: You can override the HTTP method using the `method` query parameter. This is useful for clients that can only send `GET` requests. For example, to call a `POST` endpoint, append `?method=POST` to the URL of your `GET` request.\n\n:::\n\n## Authentication\n<span id=\"/introduction/authentication\"></span>\n\nYou can find your API token on the\n[Integrations](https://console.apify.com/account#/integrations) page in the\nApify Console.\n\nTo use y ...[truncated 27 chars]
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md "name": "Apache 2.0", "url": "https://www.apache.org/licenses/LICENSE-2.0.html" }, "description": "\nThe Apify API (version 2) provides programmatic access to the [Apify\nplatform](https://docs.apify.com). The API is organized\naround [RESTful](https://en.wikipedia.org/wiki/Representational_state_transfer)\nHTTP endpoints.\n\nYou can download the complete OpenAPI schema of Apify API in the [YAML](http://docs.apify.com/api/openapi.yaml) or [JSON](http://docs.apify.com/api/openapi.json) formats. The source code is also available on [GitHub](https://github.com/apify/apify-docs/tree/master/apify-api/openapi).\n\nAll requests and responses (including errors) are encoded in\n[JSON](http://www.json.org/) format with UTF-8 encoding,\nwith a few exceptions that are explicitly described in the reference.\n\n- To access the API using [Node.js](https://nodejs.org/en/), we recommend the [`apify-client`](https://docs.apify.com/api/client/js) [NPM\npackage](https://www.npmjs.com/package/apify-client).\n- To access the API using [Python](https://www.python.org/), we recommend the [`apify-client`](https://docs.apify.com/api/client/python) [PyPI\npackage](https://pypi.org/project/apify-client/).\n\nThe clients' functions correspond to the API endpoints and have the same\nparameters. This simplifies development of apps that depend on the Apify\nplatform.\n\n:::note Important Request Details\n\n- `Content-Type` header: For requests with a JSON body, you must include the `Content-Type: application/json` header.\n\n- Method override: You can override the HTTP method using the `method` query parameter. This is useful for clients that can only send `GET` requests. For example, to call a `POST` endpoint, append `?method=POST` to the URL of your `GET` request.\n\n:::\n\n## Authentication\n<span id=\"/introduction/authentication\"></span>\n\nYou can find your API token on the\n[Integrations](https://console.apify.com/account#/integrations) page in the\nApify Console.\n\nTo use y ...[truncated 27 chars]
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md "name": "Apache 2.0", "url": "https://www.apache.org/licenses/LICENSE-2.0.html" }, "description": "\nThe Apify API (version 2) provides programmatic access to the [Apify\nplatform](https://docs.apify.com). The API is organized\naround [RESTful](https://en.wikipedia.org/wiki/Representational_state_transfer)\nHTTP endpoints.\n\nYou can download the complete OpenAPI schema of Apify API in the [YAML](http://docs.apify.com/api/openapi.yaml) or [JSON](http://docs.apify.com/api/openapi.json) formats. The source code is also available on [GitHub](https://github.com/apify/apify-docs/tree/master/apify-api/openapi).\n\nAll requests and responses (including errors) are encoded in\n[JSON](http://www.json.org/) format with UTF-8 encoding,\nwith a few exceptions that are explicitly described in the reference.\n\n- To access the API using [Node.js](https://nodejs.org/en/), we recommend the [`apify-client`](https://docs.apify.com/api/client/js) [NPM\npackage](https://www.npmjs.com/package/apify-client).\n- To access the API using [Python](https://www.python.org/), we recommend the [`apify-client`](https://docs.apify.com/api/client/python) [PyPI\npackage](https://pypi.org/project/apify-client/).\n\nThe clients' functions correspond to the API endpoints and have the same\nparameters. This simplifies development of apps that depend on the Apify\nplatform.\n\n:::note Important Request Details\n\n- `Content-Type` header: For requests with a JSON body, you must include the `Content-Type: application/json` header.\n\n- Method override: You can override the HTTP method using the `method` query parameter. This is useful for clients that can only send `GET` requests. For example, to call a `POST` endpoint, append `?method=POST` to the URL of your `GET` request.\n\n:::\n\n## Authentication\n<span id=\"/introduction/authentication\"></span>\n\nYou can find your API token on the\n[Integrations](https://console.apify.com/account#/integrations) page in the\nApify Console.\n\nTo use y ...[truncated 27 chars]
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md "name": "Apache 2.0", "url": "https://www.apache.org/licenses/LICENSE-2.0.html" }, "description": "\nThe Apify API (version 2) provides programmatic access to the [Apify\nplatform](https://docs.apify.com). The API is organized\naround [RESTful](https://en.wikipedia.org/wiki/Representational_state_transfer)\nHTTP endpoints.\n\nYou can download the complete OpenAPI schema of Apify API in the [YAML](http://docs.apify.com/api/openapi.yaml) or [JSON](http://docs.apify.com/api/openapi.json) formats. The source code is also available on [GitHub](https://github.com/apify/apify-docs/tree/master/apify-api/openapi).\n\nAll requests and responses (including errors) are encoded in\n[JSON](http://www.json.org/) format with UTF-8 encoding,\nwith a few exceptions that are explicitly described in the reference.\n\n- To access the API using [Node.js](https://nodejs.org/en/), we recommend the [`apify-client`](https://docs.apify.com/api/client/js) [NPM\npackage](https://www.npmjs.com/package/apify-client).\n- To access the API using [Python](https://www.python.org/), we recommend the [`apify-client`](https://docs.apify.com/api/client/python) [PyPI\npackage](https://pypi.org/project/apify-client/).\n\nThe clients' functions correspond to the API endpoints and have the same\nparameters. This simplifies development of apps that depend on the Apify\nplatform.\n\n:::note Important Request Details\n\n- `Content-Type` header: For requests with a JSON body, you must include the `Content-Type: application/json` header.\n\n- Method override: You can override the HTTP method using the `method` query parameter. This is useful for clients that can only send `GET` requests. For example, to call a `POST` endpoint, append `?method=POST` to the URL of your `GET` request.\n\n:::\n\n## Authentication\n<span id=\"/introduction/authentication\"></span>\n\nYou can find your API token on the\n[Integrations](https://console.apify.com/account#/integrations) page in the\nApify Console.\n\nTo use y ...[truncated 27 chars]