The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill fetches untrusted content from the public internet (search results and scraped web pages) and stores it locally in the .firecrawl/ directory. This content is eventually processed by the agent to answer questions or research topics. This represents an indirect prompt injection surface where a website could include hidden instructions to influence the agent's behavior.
Ingestion points: SKILL.md (via firecrawl search and --scrape output saved to .firecrawl/*.json)
Boundary markers: None specified in the instructions for how the agent should read the resulting files.
Capability inventory: Bash(firecrawl), Bash(npx firecrawl), Bash(jq)
Sanitization: None. The agent is encouraged to use jq to parse the JSON and then process the raw content.
[EXTERNAL_DOWNLOADS]: The skill utilizes npx firecrawl, which executes the Firecrawl CLI by downloading it from the npm registry at runtime. This is a standard deployment method for modern CLI tools.
[DATA_EXFILTRATION]: The firecrawl search-feedback command sends agent-generated metadata (ratings, valuable source lists, and descriptions of missing content) back to the Firecrawl service. While this involves sending data to a remote server, it is a documented feature of the Firecrawl API used to manage search credits and improve search quality.

firecrawl-search