The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the agent to execute shell commands using firecrawl and jq. It specifically encourages the use of background execution (&) for the feedback command, which allows the agent to continue tasks while data is being transmitted.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process arbitrary content from the web via search results, which is a primary surface for indirect prompt injection attacks.
Ingestion points: External data enters the agent's context through the output of firecrawl search and firecrawl developer (SKILL.md).
Boundary markers: There are no explicit instructions or delimiters provided to help the agent distinguish between search result content and its own system instructions.
Capability inventory: The skill uses the Bash tool to execute commands, read files, and write results to the .firecrawl/ directory (SKILL.md).
Sanitization: The documentation does not mention any sanitization or validation of the search results before they are processed by the agent or piped to other tools.
[DATA_EXFILTRATION]: The skill documents a search-feedback feature that sends metadata about the agent's activities, including search IDs, specific topics of interest, and source URLs, to the Firecrawl service. While this is a documented feature for credit management, it establishes a network path for transmitting data derived from the agent's session to an external endpoint.

firecrawl-search