call-actor

2 findings on this tool

1. mediumunconstrained inputf-r1-call_actor

   Tool `call-actor` accepts unconstrained string input

   The following string parameter(s) have no `maxLength` constraint: `actor`. Unbounded strings let an attacker stuff arbitrary payloads through the tool, including indirect-injection content.

   fix: Add a `maxLength` to each string property, or constrain with an `enum` or `pattern`. Most legitimate tool inputs fit under a few hundred bytes.

   OWASP LLM01NIST MEASURE-2.3ATLAS T0051
2. mediumindirect injectionf-r6-call_actor

   Tool `call-actor` fetches external web content -- indirect-injection surface

   Description: "Call any Actor from the Apify Store. WORKFLOW: 1. Use fetch-actor-details to get the Actor's input schema 2. Call this tool with the actor name and proper input based on the schema If the actor name is not in "username/name" format and search-actors is available in this session, use it to resolve the correct Actor first. For MCP server Actors: - Use fetch-actor-details with output={ mcpTools: true } to list available tools - Call using format: "actorName:toolName" (e.g., "apify/actors-mcp-server:fetch-apify-docs") IMPORTANT: - Waits up to waitSecs (default 30s) for completion; returns run status, storage IDs, and field metadata - Use get-dataset-items with the datasetId to fetch results; non-terminal runs include a nextStep with polling instructions - Use dedicated Actor tools when available for better experience There are two ways to run Actors: 1. Dedicated Actor tools (e.g., apify--rag-web-browser): These are pre-configured tools, offering a simpler and more direct experience. 2. Generic call-actor tool (call-actor): Use this when a dedicated tool is not available or when you want to run any Actor dynamically. This tool is especially useful if you do not want to add specific tools or your client does not support dynamic tool registration. USAGE: - Always use dedicated tools when available (e.g., apify--rag-web-browser) - Use the generic call-actor tool only if a dedicated tool does not exist for your Actor. - Use `waitSecs` (0–45) to control how long to wait. Default 30s returns results for fast actors. Use `waitSecs: 0` to start and return immediately for long-running actors. EXAMPLES: - user_input: Get instagram posts using apify/instagram-scraper" -- this tool pulls externally-controlled content into the agent's context window, the canonical indirect-injection vector. Even when the user supplies the URL, content at that URL can carry hostile instructions.

   fix: Sandbox the fetched content: strip prompts before forwarding to the model, constrain to an allow-list of domains, and route through capframe-guard with a `domain in [...]` caveat.

   OWASP LLM01NIST MEASURE-2.3ATLAS T0051