url-to-markdown
Pass
Audited by Gen Agent Trust Hub on Mar 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell scripts to automate the management of a local Docker services stack. It executes
docker compose upto initialize services anddocker compose downfor cleanup after an idle period. It also runs thefirecrawlCLI to perform web scraping and conversion (scripts/url_to_markdown_up.sh, scripts/url_to_markdown_scrape.sh). - [EXTERNAL_DOWNLOADS]: The skill configuration downloads official Docker images from the GitHub Container Registry (
ghcr.io/firecrawl/firecrawlandghcr.io/firecrawl/playwright-service). Additionally, it builds thenuq-postgresservice directly from the official Firecrawl GitHub repository. These sources are well-known within the developer community and are necessary for the self-hosted stack functionality (scripts/url_to_markdown_up.sh). - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it fetches and processes content from arbitrary external URLs provided by the user.
- Ingestion points: The main scrape script (
scripts/url_to_markdown_scrape.sh) accepts a URL as input and retrieves its web content via the Firecrawl API. - Boundary markers: Scraped markdown is printed to stdout and fed to the agent context without explicit delimiters or instructions for the agent to ignore any embedded directives within the scraped text.
- Capability inventory: The skill has the capability to execute local commands (docker, firecrawl), manage state files in a skill-specific directory, and perform network requests.
- Sanitization: The scripts perform basic protocol validation (checking for
http://orhttps://) but do not sanitize the resulting markdown to filter out potential prompt injection payloads hidden in the scraped content.
Audit Metadata