firecrawl-developer-index
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of content from external, untrusted sources such as public GitHub issues, pull requests, and third-party documentation websites. This creates a potential surface for indirect prompt injection if the indexed content contains malicious instructions.
- Ingestion points: untrusted data enters the agent context via the firecrawl_developer_search, firecrawl_search, and firecrawl_scrape tools as described in SKILL.md.
- Boundary markers: while the skill advises quoting passages and citing URLs, it lacks explicit instructions to use delimiters or warnings that would prompt the agent to ignore instructions embedded in the external content.
- Capability inventory: the skill is limited to search and read operations and does not define any capabilities for subprocess execution, file-system writes, or network operations beyond the tool calls.
- Sanitization: the instructions do not specify any validation or sanitization procedures for the external content before it is processed by the agent.
Audit Metadata