firecrawl

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required runtime workflow for this skill invokes Firecrawl subcommands (e.g., firecrawl scrape / search) to fetch externally hosted page content and then uses the agent’s Read tool to ingest slices of the saved markdown/JSON files into the conversation, meaning outsider-authored free text can be ingested when a user supplies or triggers which URLs/queries to scrape.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly demonstrates scraping external pages at runtime (e.g., firecrawl scrape "https://www.gnu.org/software/bash/manual/bash.html") and then reading that fetched content into the agent context, so those external URLs can directly control prompts.