firecrawl-scrape
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest data from external, untrusted web sources. This inherent capability creates a surface for indirect prompt injection, where malicious content on a scraped page could attempt to subvert the agent's logic.
- Ingestion points: Web content retrieved from arbitrary URLs via the Firecrawl API.
- Boundary markers: The SKILL.md instructions explicitly state to treat collected page text as untrusted source material and not as instructions.
- Capability inventory: The skill can write results to the local file system via the --output flag and performs network requests to the Frevana API.
- Sanitization: The skill returns raw or structured JSON data from the provider without interpreting it as code.
- [COMMAND_EXECUTION]: The implementation uses subprocess.run within scripts/firecrawl.py to manage a worker process for network requests. This design pattern is used to enforce strict execution timeouts and is implemented safely by passing parameters through JSON serialization over stdin rather than shell interpolation.
Audit Metadata