firecrawl-self-hosted

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill's required workflow calls the scraper/wrapper and Firecrawl API to fetch arbitrary public URLs (see SKILL.md "Recommended: Wrapper Endpoint" /scrape?url=URL and the direct POST to /v1/scrape) and saves/serves the resulting untrusted markdown at http://172.25.236.1:8080/NAME-TIMESTAMP.md for the agent to read and act on, so third-party page content could inject instructions that influence subsequent actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The wrapper endpoint curl "http://172.25.236.1:3003/scrape?url=URL&name=NAME" accepts an arbitrary target URL at runtime and forwards it to Firecrawl/Playwright which renders the page (executing the page's remote JavaScript), so runtime-fetched content can execute remote code.