firecrawl
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the shell to execute commands via
npx @useclawlink/cli. This includes logging in, connecting to the Firecrawl service, and running various scraping/crawling actions. It notes that authentication credentials are stored locally at~/.clawlink/credentials.json. - [EXTERNAL_DOWNLOADS]: The instructions direct the agent to use
npxto download and run the@useclawlink/clipackage from the official NPM registry at runtime. - [INDIRECT_PROMPT_INJECTION]: The skill's core functionality involves scraping, crawling, and searching external websites. This content is untrusted and is subsequently processed by the AI agent, creating a surface for indirect prompt injection attacks.
- Ingestion points: Data returned from actions like
firecrawl_scrape,firecrawl_crawl, andfirecrawl_search(SKILL.md). - Boundary markers: None identified in the provided instructions to delimit scraped content.
- Capability inventory: The agent has shell command execution capabilities through the CLI tool (SKILL.md).
- Sanitization: No explicit sanitization or filtering of the scraped content is mentioned in the skill definition.
Audit Metadata