firecrawl-data-handling
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides instructions for processing external content scraped by Firecrawl, which constitutes an indirect prompt injection surface. The instructions explicitly address this by requiring the agent to treat all scraped material as untrusted.\n
- Ingestion points: Firecrawl document data, metadata, and extracted JSON (SKILL.md).\n
- Boundary markers: The instructions mandate that scraped instructions be kept outside the trusted agent context and recommend quarantining data if provenance is missing.\n
- Capability inventory: The skill is restricted to standard file operations (Read, Glob, Grep, Write, Edit).\n
- Sanitization: Mandatory steps include HTML/Markdown sanitization, neutralization of active content, and schema validation for JSON extraction.\n- [EXTERNAL_DOWNLOADS]: The skill includes references to official documentation and repositories for the Firecrawl service.\n
- Evidence: Informational links to docs.firecrawl.dev and github.com/firecrawl are provided in references/official-docs.md to support implementation. These are well-known resources within the scraping and data extraction ecosystem.
Audit Metadata