firecrawl
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted content from the public web via the Firecrawl API. It includes scripts like
extract.pyandagent.pythat use natural language prompts to steer the extraction of data from this untrusted content. - Ingestion points: Web content is fetched from arbitrary URLs provided by the user or discovered via search in
scripts/scrape.py,scripts/crawl.py,scripts/search.py,scripts/extract.py, andscripts/agent.py. - Boundary markers: No explicit boundary markers (e.g., XML tags or delimiters) or 'ignore embedded instructions' warnings are present in the scripts when interpolating the user's prompt with the fetched web data.
- Capability inventory: The skill possesses network read capabilities (via the Firecrawl SDK) and outputs data to stdout, which may be consumed by an AI agent's context, potentially influencing subsequent agent actions.
- Sanitization: There is no evidence of sanitization or filtering to prevent malicious instructions embedded in scraped HTML/Markdown from being interpreted as instructions by the downstream LLM.
Audit Metadata