The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the public web, creating a potential surface for indirect prompt injection if the agent interprets embedded instructions within the scraped data.
Ingestion points: External data enters the agent context through the scrape, crawl, batchScrape, search, and startAgent tools, which fetch content from arbitrary URLs.
Boundary markers: The skill returns data within a structured JSON envelope ({ data, meta }), providing clear separation between the tool's output and its metadata.
Capability inventory: The skill provides powerful browser automation capabilities via executeBrowserCode and interactWithScrape, which can execute agent-generated code in a remote sandbox.
Sanitization: While the Firecrawl API performs deterministic cleaning of HTML to produce Markdown, it does not filter or sanitize natural language instructions embedded in the web content.
[DYNAMIC_EXECUTION]: The executeBrowserCode and interactWithScrape tools allow the agent to generate and execute code (supporting Node.js, Python, and Bash runtimes) within a remote browser sandbox hosted by the Firecrawl API. While this is an intended feature of the Firecrawl service for handling interactive web elements, it represents a dynamic execution vector where the agent determines the code to be run based on the task and environment.

firecrawl