The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to fetch and process untrusted data from the web and local documents, which represents a significant surface for indirect prompt injection attacks. \n
Ingestion points: Untrusted content enters the agent's context through several commands including firecrawl scrape, firecrawl search, firecrawl crawl, firecrawl agent, and firecrawl parse. \n
Boundary markers: The skill includes explicit security instructions in references/output-security.md to mitigate risks, such as treating page content strictly as data rather than instructions and using local artifacts to isolate fetched payloads. \n
Capability inventory: The agent has permissions to execute the firecrawl binary and internal JavaScript utility scripts, allowing it to perform network requests (via the CLI) and manage a local cache in the .firecrawl/ directory. \n
Sanitization: The scripts/firecrawl-cache-index.mjs utility script includes proactive sanitization logic to strip sensitive query parameters like access_token, api_key, jwt, and secret from URLs before they are stored in the local index. The skill also provides support for PII redaction via CLI flags. \n- [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill facilitates the installation and execution of the firecrawl-cli package from the NPM registry using bun. While this is a standard dependency for the skill's operation, it involves running code from a remote repository. \n- [DYNAMIC_EXECUTION]: The firecrawl interact command enables the execution of Node.js, Python, or Bash code snippets within a browser session. Although this is a native feature of the Firecrawl service for web automation, it grants the agent the ability to generate and run code dynamically in the browser context.

firecrawl