firecrawl-interact

Pass

Audited by Gen Agent Trust Hub on Jul 29, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the Bash tool to run firecrawl CLI commands, allowing the agent to control browser sessions and perform complex web interactions.
  • [EXTERNAL_DOWNLOADS]: Instructions suggest using npx firecrawl, which downloads the latest version of the Firecrawl package from the npm registry at runtime.
  • [REMOTE_CODE_EXECUTION]: The --code option in firecrawl interact allows for the execution of bash, python, or node snippets within the browser environment to facilitate precise control over page elements.
  • [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests data from third-party websites and performs actions based on that data.
  • Ingestion points: External webpage content retrieved via the firecrawl scrape command (SKILL.md).
  • Boundary markers: None identified; the skill does not explicitly instruct the agent to ignore or delimit instructions found within the scraped content.
  • Capability inventory: The skill can execute shell commands (Bash), perform network requests (via the CLI), and execute code in a browser context (--code).
  • Sanitization: No sanitization or validation of the scraped webpage content is described before it is used to drive interactions.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 29, 2026, 06:45 AM
Security Audit — agent-trust-hub — firecrawl-interact