firecrawl-developer-index
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to fetch and process data from external, third-party sources including GitHub repositories and general web pages, which represents an attack surface for indirect prompt injection.
- Ingestion points: The tools
firecrawl_developer_search,firecrawl_search, andfirecrawl_scrape(SKILL.md) ingest external markdown and text content into the agent's context. - Boundary markers: The skill instructions do not specify the use of delimiters or 'ignore' instructions to prevent the agent from following potential commands embedded in the fetched documentation.
- Capability inventory: The skill does not include capabilities for file system modification, privilege escalation, or arbitrary code execution, which limits the potential impact of an injection.
- Sanitization: There is no evidence of content sanitization or filtering applied to the search results before they are presented to the agent.
- [DATA_EXFILTRATION]: The skill instructions specify network operations to an external domain for search functionality.
- Evidence: The skill communicates with
api.firecrawl.dev(SKILL.md) to retrieve search results. This domain belongs to the skill's vendor and is used for its primary functionality.
Audit Metadata