firecrawl-monitor
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation suggests using
npx firecrawl-cli, which downloads the official Firecrawl package from the npm registry. This is a common method for accessing the service's features. - [COMMAND_EXECUTION]: The skill uses the
firecrawlCLI to perform operations such as creating, updating, and running monitors. These commands are legitimate uses of the tool to interact with its cloud API. - [DYNAMIC_EXECUTION]: In structured tracking mode, the skill allows defining extraction logic through a
promptandschemapassed via JSON. This enables dynamic data processing by the underlying scraping engine based on user-provided templates. - [INDIRECT_PROMPT_INJECTION]: The skill monitors external web content and triggers alerts based on an AI-driven goal. This creates a surface where malicious content on a monitored site could potentially influence the alert logic.
- Ingestion points: Web content is ingested from external URLs specified in
SKILL.md(e.g., via the--pageor--crawl-urlflags). - Boundary markers: There are no explicit instructions or delimiters mentioned to separate the scraped data from the AI judging instructions.
- Capability inventory: The skill can retrieve web data and send notifications via webhooks and email, as documented in
SKILL.md. - Sanitization: No explicit sanitization of the scraped website content is described before it is evaluated by the AI change judge.
Audit Metadata