The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection by design as it ingests untrusted data from external websites.
Ingestion points: Content is fetched from arbitrary user-specified URLs using the firecrawl download command and stored in the .firecrawl/ directory.
Boundary markers: The instructions lack explicit boundary markers or warnings to the agent to disregard instructions potentially embedded within the downloaded markdown or HTML files.
Capability inventory: The skill has access to the Bash tool, which allows for broader command execution in the environment.
Sanitization: There is no mention of sanitization or filtering of the external content before it is saved to the local file system.
[COMMAND_EXECUTION]: The skill uses the Bash tool to execute the firecrawl CLI.
Evidence: allowed-tools includes Bash(firecrawl *) and Bash(npx firecrawl *).
The instructions explicitly recommend using the -y flag to skip interactive confirmation prompts during automation.
[EXTERNAL_DOWNLOADS]: The skill downloads the firecrawl utility from the npm registry.
Evidence: npx firecrawl is used to execute the tool, which triggers a download from the npm registry if the package is not already cached locally.

firecrawl-download