flarecrawl-ops
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions prompt for the installation of the 'flarecrawl' package and several optional dependencies including 'websockets', 'curl_cffi', 'playwright', and 'PyYAML' via 'uv pip'. These are third-party packages required to enable the full functionality of the scraper and its MCP/CDP components.
- [COMMAND_EXECUTION]: The skill makes extensive use of the 'flarecrawl' CLI and pipes its JSON output into standard shell utilities like 'jq' for data processing. It also includes instructions for starting an MCP stdio server.
- [INDIRECT_PROMPT_INJECTION]: As a web scraping tool, the skill is designed to ingest and process content from arbitrary external URLs, which serves as a surface for indirect prompt injection.
- Ingestion points: Untrusted data is ingested through 'scrape', 'crawl', 'map', and 'fetch' operations in SKILL.md.
- Boundary markers: The skill explicitly mentions a specialized '--agent-safe' flag designed to 'sanitise adversarial content' and remove prompt injections from scraped text.
- Capability inventory: The agent has the ability to write files (PDFs, screenshots, markdown downloads), perform network requests, and execute shell commands.
- Sanitization: The tool provides a built-in safety mode with 13 sanitizers targeting HTML and text phases to mitigate potential injection risks found in web content.
Audit Metadata