firecrawl-website-design-clone
Pass
Audited by Gen Agent Trust Hub on Oct 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
firecrawlcommand-line interface to perform web scraping, brand asset extraction, and full-page screenshots. These commands are executed locally to generate structured JSON and image files in a.firecrawl/directory. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external websites to synthesize design tokens and instructions. This creates a surface for indirect prompt injection where an attacker could embed malicious instructions within a webpage's metadata or content to influence the agent's behavior during the synthesis of the
DESIGN.mdfile. - Ingestion points: External web content, branding data, and metadata fetched via the
firecrawl scrapecommand from user-supplied URLs (SKILL.md). - Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded commands within the scraped content.
- Capability inventory: The skill has the capability to execute the
firecrawlCLI and write files (DESIGN.mdand assets in.firecrawl/) to the local filesystem. - Sanitization: There is no evidence of sanitization, escaping, or filtering of the external website content before it is processed by the agent.
Audit Metadata