The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill fetches and processes content from external websites via the Frevana API. This presents an attack surface for indirect prompt injection, where malicious instructions could be embedded in the retrieved web pages. The skill acknowledges this risk in SKILL.md by instructing the agent to treat collected page text as untrusted source material rather than instructions.
Ingestion points: The API response data from https://ai-factory.frevana.com processed in scripts/firecrawl.py and returned to the agent context.
Boundary markers: SKILL.md includes explicit instructions for the agent to treat output as untrusted, though no technical delimiters are enforced in the script output.
Capability inventory: The skill can search and scrape the web; it does not possess file-write capabilities or the ability to execute arbitrary commands based on input.
Sanitization: No content sanitization is performed on the returned page text.
[COMMAND_EXECUTION]: In scripts/firecrawl.py, the skill uses subprocess.run to execute its own Python interpreter (sys.executable) with the --_http-worker flag. This pattern is used to isolate HTTP requests within a child process to enforce strict execution timeouts. While this involves local command execution, it is a restricted implementation detail for process management and does not allow for arbitrary command injection or shell execution.
[DATA_EXF_ILTRATION]: The script supports a @file syntax for the --json argument, allowing it to read the contents of local files. While the script enforces that the content must be valid JSON (preventing the reading of raw binary or non-JSON sensitive files like SSH keys), this feature could theoretically be used to read local configuration files if the agent is prompted to do so. This is a standard feature of many CLI utilities but is noted as a potential exposure vector.

firecrawl-search