firecrawl-scrape
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions provide various examples of using the
firecrawlCLI andnpx firecrawl-clito extract content from web pages and save it to the local filesystem. - [EXTERNAL_DOWNLOADS]: The skill utilizes
npxto fetch and run thefirecrawl-clitool. The package is a vendor-owned resource used to provide the skill's primary functionality. - [INDIRECT_PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection by fetching content from arbitrary external URLs and providing the resulting markdown to the agent. This is an inherent risk of web scraping tools.
- Ingestion points: Untrusted content is ingested from external URLs via the
firecrawl scrapecommand as described inSKILL.md. - Boundary markers: Absent; there are no specific instructions provided to the agent to treat the scraped content as data rather than instructions.
- Capability inventory: The skill can execute the
firecrawlcommand-line tool, which includes network access and the ability to write files to the.firecrawl/directory. - Sanitization: The tool filters navigation and footers when requested and converts HTML to markdown, which provides basic structural sanitization.
- Ingestion points: Untrusted content is ingested from external URLs via the
Audit Metadata