firecrawl-parse
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes
npx firecrawl, which fetches the Firecrawl CLI package from the official NPM registry at runtime. This is the standard distribution method for the tool. - [COMMAND_EXECUTION]: The skill executes the
firecrawl parsecommand via a shell environment to process local files. It includes options for AI-based summarization (-S) and querying (-Q), with instructions to save output to a local.firecrawl/directory to manage context size. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from local files such as PDFs and Word documents. While these files could contain adversarial instructions, the risk is mitigated by the tool's conversion of content into markdown format and the agent's instructions to use targeted tools like
greporheadfor processing the results.
Audit Metadata