firecrawl-build-onboarding
Pass
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the Firecrawl CLI (
firecrawl-cli) and official SDKs (@mendable/firecrawl-js,firecrawl-py) from public registries (NPM and PyPI) to set up the development environment. - [REMOTE_CODE_EXECUTION]: The skill instructs the execution of remote code by using
npxto fetch and run thefirecrawl-clitool directly from the NPM registry. - [COMMAND_EXECUTION]: The skill utilizes local shell commands (
openssl) to generate security parameters (session ID, code verifier, and code challenge) required for the PKCE-based browser authentication flow. - [PROMPT_INJECTION]: The skill directs the agent to ingest implementation details and usage examples from Firecrawl's official documentation site (
docs.firecrawl.dev). This is a documented surface for indirect instructions, used here for authoritative implementation guidance. - Ingestion points: Official documentation links in
SKILL.md. - Boundary markers: None identified for external documentation content.
- Capability inventory: Shell execution (
npx,npm,pip,openssl), file system writes (.env), and network requests (API polling for auth status). - Sanitization: No specific sanitization or validation of the remote documentation content is described.
Audit Metadata