firecrawl
Pass
Audited by Gen Agent Trust Hub on Mar 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the Bash tool to execute firecrawl and npx commands for web scraping, searching, and managing editor-integrated skills.\n- [EXTERNAL_DOWNLOADS]: The skill facilitates downloading the firecrawl-cli package from the NPM registry to enable its core functionality.\n- [PROMPT_INJECTION]: The skill processes untrusted content from the web which could contain malicious instructions (indirect prompt injection). It mitigates this via its security policy requiring output isolation and incremental reading.\n
- Ingestion points: Web content from search, scrape, and crawl operations in SKILL.md and rules/security.md.\n
- Boundary markers: Encourages writing results to the gitignored .firecrawl/ directory using the -o flag.\n
- Capability inventory: Shell execution via the Bash tool and network access via the firecrawl CLI.\n
- Sanitization: The rules/security.md file explicitly instructs the agent to treat fetched data as untrusted and avoid following instructions found within it.
Audit Metadata