firecrawl-website-design-clone
Warn
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to construct and execute shell commands using the
firecrawlCLI with user-provided input (firecrawl scrape "[URL]"). If the agent does not properly escape the URL input, this could lead to command injection where an attacker provides a malicious URL containing shell metacharacters to execute arbitrary commands on the host system.- [PROMPT_INJECTION]: The skill ingests untrusted data from external websites (including page markdown, headings, and metadata) and processes it to generate aDESIGN.mdfile. There is a risk of indirect prompt injection as the skill lacks explicit boundary markers or instructions to the agent to disregard instructions embedded within the scraped content. - Ingestion points: Scraped content (HTML, Markdown, Metadata) from external URLs provided by the user.
- Boundary markers: Absent. The skill does not provide instructions to delimit or treat the scraped data as untrusted text.
- Capability inventory: Shell command execution (
firecrawlCLI), file writing (DESIGN.md,.firecrawl/directory), and sub-agent tasking. - Sanitization: Absent. There are no instructions to sanitize, escape, or validate the content retrieved from external websites before processing.
Audit Metadata