firecrawl
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted data from the web via scraping and crawling, creating a surface for indirect prompt injection. \n
- Ingestion points: Web content retrieved via scrape, search, and crawl commands in SKILL.md and context/commands.md. \n
- Boundary markers: The skill mandates writing results to temporary files and using selective read operations to minimize context pollution. \n
- Capability inventory: Bash tool access for CLI operations and interaction scripts. \n
- Sanitization: Data is structured into markdown or JSON by the Firecrawl service. \n- [DATA_EXFILTRATION]: The parse command transmits local files (PDF, DOCX, etc.) to the official Firecrawl API at api.firecrawl.dev for server-side extraction. This is a primary feature of the service and targets well-known infrastructure. \n- [COMMAND_EXECUTION]: The skill uses the Bash tool to execute firecrawl commands, including the interact subcommand which can run JavaScript or Python scripts within a browser context. \n- [EXTERNAL_DOWNLOADS]: The documentation references the installation of the firecrawl-cli package from the official npm registry. \n- [COMMAND_EXECUTION]: A dynamic status check is executed at load time via shell command in the SKILL.md frontmatter to verify the CLI installation and authentication status.
Audit Metadata