firecrawl

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s required runtime workflow exposes “read” of outsider-authored free text via Firecrawl tool calls that scrape/crawl/search arbitrary URLs and return their page content (e.g., scrape returns markdown/HTML from the specified URL, and search can optionally scrape results), so an outsider can supply a URL/query that leads to ingestion of attacker-controlled web page text.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill makes runtime calls to Firecrawl API endpoints that execute user-supplied code or prompts (e.g. https://api.firecrawl.dev/v2/interact/${encodeURIComponent(input.sessionId)}/execute, https://api.firecrawl.dev/v2/scrape/${encodeURIComponent(input.jobId)}/interact, and https://api.firecrawl.dev/v2/agent/${encodeURIComponent(input.jobId)}), so the external API is invoked at runtime to run code/agent prompts.