firecrawl-migration-deep-dive
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEDYNAMIC_CONTEXT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_CONTEXT_INJECTION]: The skill uses dynamic context injection (the
!pattern) to execute a shell command when the skill is loaded. The commandnpm list puppeteer playwright cheeriois used to detect existing dependencies in the environment. This is a diagnostic function relevant to the skill's purpose and does not involve exfiltration or sensitive file access. - [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to scrape and crawl external URLs using Firecrawl, which creates a surface for indirect prompt injection if the retrieved content contains malicious instructions.
- Ingestion points: Data retrieved from external websites via the
@mendable/firecrawl-jslibrary (inSKILL.md). - Boundary markers: The skill does not explicitly define delimiters or specific "ignore embedded instructions" warnings for the processed content.
- Capability inventory: The skill is configured with access to file manipulation tools (
Read,Write,Edit) and shell execution (Bash,Grep). - Sanitization: The instructions suggest using JSON schema extraction to structure data, which provides format validation but does not include explicit logic to sanitize for natural language instructions embedded in the scraped data.
Audit Metadata