url-to-markdown

Pass

Audited by Gen Agent Trust Hub on Mar 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses shell scripts to automate the management of a local Docker services stack. It executes docker compose up to initialize services and docker compose down for cleanup after an idle period. It also runs the firecrawl CLI to perform web scraping and conversion (scripts/url_to_markdown_up.sh, scripts/url_to_markdown_scrape.sh).
  • [EXTERNAL_DOWNLOADS]: The skill configuration downloads official Docker images from the GitHub Container Registry (ghcr.io/firecrawl/firecrawl and ghcr.io/firecrawl/playwright-service). Additionally, it builds the nuq-postgres service directly from the official Firecrawl GitHub repository. These sources are well-known within the developer community and are necessary for the self-hosted stack functionality (scripts/url_to_markdown_up.sh).
  • [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it fetches and processes content from arbitrary external URLs provided by the user.
  • Ingestion points: The main scrape script (scripts/url_to_markdown_scrape.sh) accepts a URL as input and retrieves its web content via the Firecrawl API.
  • Boundary markers: Scraped markdown is printed to stdout and fed to the agent context without explicit delimiters or instructions for the agent to ignore any embedded directives within the scraped text.
  • Capability inventory: The skill has the capability to execute local commands (docker, firecrawl), manage state files in a skill-specific directory, and perform network requests.
  • Sanitization: The scripts perform basic protocol validation (checking for http:// or https://) but do not sanitize the resulting markdown to filter out potential prompt injection payloads hidden in the scraped content.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 30, 2026, 12:34 PM