audit-performance

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required workflow ingests outsider-authored free text via Firecrawl’s web search and scrape steps (“firecrawl_search” and then “firecrawl_scrape” of the best result), meaning attacker-published content can be read by the LLM without prior selection beyond being returned as a search result.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill issues a runtime fetch via firecrawl:firecrawl_scrape with "url": "", which would load remote page content into the agent context and therefore can directly influence prompts/instructions.