Security audit

Apify

Security checks across malware telemetry and agentic risk

Overview

The skill is a real Apify integration, but it exposes much broader account-changing Apify API power than its scraping-and-results purpose needs.

Install only if you are comfortable giving the agent an Apify token that may have broad account authority. Prefer a restricted Apify token if available, avoid using it on private/internal URLs or sensitive data without explicit confirmation, and do not let the agent create schedules, webhooks, actors, builds, environment variables, or account-limit changes unless you specifically intend those actions.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The skill is described as a narrow tool to run Apify Actors and retrieve scraping results, but the manifest exposes a much broader account-management API surface. This violates least privilege and can let a caller perform unrelated high-impact operations such as modifying resources, deployments, storage, schedules, and account state under the same granted token.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The manifest includes user account endpoints for private profile, monthly usage, and especially updating account limits. In a scraping skill context, exposing account administration creates an unnecessary path to alter billing/retention settings or disclose sensitive account metadata unrelated to the user's requested task.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: Webhook creation, update, deletion, testing, and dispatch inspection are outside the stated purpose of scraping and result retrieval. These endpoints can be abused to create persistence and external data exfiltration channels by sending run data or account events to attacker-controlled URLs.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: Schedule management enables recurring or delayed execution of Actors and tasks, which exceeds a simple on-demand scraping capability. This can be abused to establish persistence, create repeated jobs that incur cost, or run future actions without contemporaneous user approval.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The skill can create, update, and delete datasets, key-value stores, request queues, and their contents, not just read scrape outputs. In practice this broad mutation surface can destroy stored data, overwrite inputs/outputs, or manipulate queue state to influence future crawls and agent behavior.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The manifest exposes endpoints to create/update/delete Actors, manage versions, environment variables, builds, and publishing-related metadata. In effect, the skill can alter executable code and secrets on the Apify platform, turning a scraping helper into a deployment and remote-code-management interface with severe account compromise potential.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The skill description is broad enough to trigger on many generic requests about websites, scraping, or data extraction, which increases the chance the agent invokes a capability that sends user-supplied URLs, queries, or target data to an external third-party platform. In this context, overbroad activation is risky because the skill executes remote Apify Actors, not just local formatting or passive lookup.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs the agent to run third-party scraping actors and transmit URLs, queries, and potentially retrieved site content to Apify without any privacy notice, consent checkpoint, or warning that execution occurs on external infrastructure. This is dangerous because user input may include internal URLs, personal data, credentials-in-context, or confidential targets that would be exposed to a third-party service and potentially to actor authors.

Vague Triggers

Low

Confidence: 90% confidence
Finding: The spec explicitly supports passing API tokens in query parameters, which are commonly logged by proxies, servers, browser history, and monitoring systems. Even though the text notes this is less secure, including it as a first-class auth mechanism increases the chance of credential leakage in agent tooling and transcripts.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.