firecrawl-mcp

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly fetches and ingests open web content — SKILL.md documents tools like firecrawl_scrape, firecrawl_search, firecrawl_crawl, and firecrawl_agent (and scripts such as scripts/firecrawl_scrape.py and scripts/firecrawl_agent.py) that accept arbitrary URLs/queries/prompts, autonomously read pages, extract structured data, and drive subsequent agent/browser actions, so untrusted third-party page content can directly influence tool behavior.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill accepts and fetches arbitrary external target URLs at runtime (e.g., the example "https://docs.firecrawl.dev" passed to firecrawl_agent/firecrawl_extract/firecrawl_scrape), and the fetched page content is injected into the agent/LLM workflow (and can trigger executeJavascript actions), so remote pages can directly control prompts or agent-executed actions.