When

1 finding on this tool

1. mediumindirect injectionf-r6-when

   Tool `When` fetches external web content -- indirect-injection surface

   Description: "status is "completed", the response includes the extracted data **Best for:** - Complex research tasks where you don't know the exact URLs - Multi-source data gathering - Finding information scattered across the web - Tasks where you can do other work while waiting for results **Not recommended for:** - Simple single-page scraping where you know the URL (use scrape with JSON format - faster and cheaper) **Arguments:** - `prompt`: Natural language description of the data you want (required, max 10,000 characters) - `urls`: Optional array of URLs to focus the agent on specific pages - `schema`: Optional JSON schema for structured output **Prompt Example:** > "Find the founders of Firecrawl and their backgrounds" **Usage Example (start agent, then poll for results):** ```json { "name": "fi..." -- this tool pulls externally-controlled content into the agent's context window, the canonical indirect-injection vector. Even when the user supplies the URL, content at that URL can carry hostile instructions.

   fix: Sandbox the fetched content: strip prompts before forwarding to the model, constrain to an allow-list of domains, and route through capframe-guard with a `domain in [...]` caveat.

   OWASP LLM01NIST MEASURE-2.3ATLAS T0051