firecrawl-core-workflow-b
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from external web sources and files via Firecrawl operations (map, search, batchScrape, parse), which creates a surface for indirect prompt injection. 1. Ingestion points: External web content and file bytes retrieved during scraping and parsing operations described in SKILL.md. 2. Boundary markers: The instructions lack specific technical delimiters (such as XML tags) for the ingested data within the prompt instructions. 3. Capability inventory: The agent is granted Write and Edit tool access in SKILL.md. 4. Sanitization: The skill includes robust mitigation instructions, requiring the agent to treat extracted data as untrusted, validate it against JSON schemas, and quarantine results that trigger prompt-injection protections.
- [SAFE]: The skill references documentation and source code from Firecrawl's official GitHub organization and official domain (docs.firecrawl.dev). These are well-known services and the references are documented for informational purposes without dangerous execution patterns.
Audit Metadata