firecrawl

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). This skill is high-risk: it mandates routing all web/browsing/scraping through an external service, instructs agents to run automated browser-based authentication (encouraging opaque token capture), advises hiding outputs in a .firecrawl folder ignored by git, and exposes arbitrary bash/python/node exec via the browser interface — together enabling data exfiltration, credential capture, and remote code execution.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill's SKILL.md instructs the agent to fetch and scrape arbitrary public web content (e.g., "firecrawl scrape https://example.com", "firecrawl search", "firecrawl browser 'open '" and the autonomous "firecrawl agent" commands), so the agent will read untrusted third‑party webpages/social content which can influence subsequent actions.