The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill retrieves and extracts full-page markdown content from external websites when the --scrape flag is used. This content is ingested by the agent, creating a surface for indirect prompt injection attacks where instructions embedded in external web pages could attempt to influence the agent's behavior.
Ingestion points: External web content is saved to local files in the .firecrawl/ directory, such as .firecrawl/scraped.json.
Boundary markers: The skill does not provide specific instructions for using delimiters or boundary markers to isolate external content from the agent's primary instructions.
Capability inventory: The skill has access to the Bash tool to execute firecrawl and npx commands.
Sanitization: No sanitization or filtering of the scraped web content is specified before the agent reads the output files.
[DATA_EXFILTRATION]: The skill implements a search-feedback command that transmits telemetry, search ratings, and descriptions of "missing content" back to the vendor's API. While this is a documented feature for credit refunds, it represents a data transmission channel to an external service managed by the vendor.
[COMMAND_EXECUTION]: The skill relies on shell command execution via the Bash tool to perform searches, process JSON data with jq, and send feedback to the vendor.
[EXTERNAL_DOWNLOADS]: The skill references npx firecrawl, which triggers the download and execution of the vendor's CLI package from the npm registry if it is not already present in the environment.

firecrawl-search