Skip to content
skillsafebeta
← Report library
Purpose / Other

Firecrawl Agent Skill Security Audit

What the author says it does (original text)

|

Independent security check

Security risks found

Files checked
1
Risks found
3
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Provided URLs are visited by an external crawling agent

Source references: 2
What we found

The Skill directs a Firecrawl agent to navigate sites autonomously and accepts user-supplied URLs. If a URL contains signed query parameters, access tokens, or points to non-public material, that information enters the crawling workflow.

Why this matters

Credentials embedded in a sensitive URL, or content reachable through it, may be exposed to Firecrawl and its processing chain. The provided text does not define retention, logging, or privacy boundaries.

This Skill's stated operation is autonomous website navigation, and it provides an active command that passes a specified URL to the agent. If a user supplies a URL containing signed parameters, tokens, or an internal-resource address, that full string becomes command input to the external crawling workflow; no redaction or access boundary is described. Users should provide only public URLs or ask where URLs, page content, and credentials are sent and retained.

SKILL.md:12In the instructionsOpen original file
AI-powered autonomous extraction. The agent navigates sites and extracts structured data (takes 2-5 minutes).
Show 1 other places
SKILL.md:23In the instructionsOpen original file
# Focus on specific pagesfirecrawl agent "get feature list" --urls "<url>" --wait --json -o .firecrawl/features.json```
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Low risk

The install command does not pin a dependency version

Source references: 2
What we found

The installation command does not specify dependency versions. The same command may download different code later, so what you install can differ from what was checked.

Why this matters

A later install may download different code even though the command and this report have not changed.

Legitimate use of this code

Line 7 only grants permission to invoke `npx firecrawl-cli`; it is not an installation command. The shown source contains no `install`, package name, or dependency-resolution step, so it does not support a claim that unpinned code will be downloaded. A user could ask the author to document the CLI's installation source and pinned version, but this candidate's cited evidence is benign in context.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:7In the instructionsOpen original file
  - Bash(firecrawl *)  - Bash(npx firecrawl-cli *)---
Show 1 other places
SKILL.md:5In the instructionsOpen original file
  Autonomous multi-page extraction into structured JSON. Use when the user wants website data matching a schema — pricing tiers, product listings — beyond a single-page scrape.allowed-tools:  - Bash(firecrawl *)  - Bash(npx firecrawl-cli *)---
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
Medium risk

Example runs do not cap paid credit usage

Source references: 2
What we found

The Skill states that agent runs consume more credits than simple scrapes, but none of its quick-start commands uses `--max-credits`.

Why this matters

A broad site or extensive autonomous exploration could incur more Firecrawl usage charges than the user expects.

The quick-start command waits for an agent job and writes its result without setting a credit ceiling. The same file says agent runs consume more credits than simple scrapes and identifies `--max-credits` as the spending control. Copying the example can therefore incur service-credit usage without a preset cap. Users can require an estimated cost and enforce an acceptable maximum before running it.

SKILL.md:18In the instructionsOpen original file
# Extract structured datafirecrawl agent "extract all pricing tiers" --wait --json -o .firecrawl/pricing.json# With a JSON schema for structured outputfirecrawl agent "extract products" --schema '{"type":"object","properties":{"name":{"type":"string"},"price":{"type":"number"}}}' --wait --json -o .firecrawl/products.json# Focus on specific pagesfirecrawl agent "get feature list" --urls "<url>" --wait --json -o .firecrawl/features.json```
Show 1 other places
SKILL.md:50In the instructionsOpen original file
- Use `--schema` for predictable, structured output — otherwise the agent returns freeform data.- Agent runs consume more credits than simple scrapes. Use `--max-credits` to cap spending.- For simple single-page extraction, prefer `scrape` — it's faster and cheaper.

Inside this skill

4 instruction sections

The Skill uses Firecrawl's AI agent to navigate multiple web pages and write extracted results as structured JSON; a run typically takes 2–5 minutes.

View source
SKILL.md:12In the instructionsOpen original file
AI-powered autonomous extraction. The agent navigates sites and extracts structured data (takes 2-5 minutes).
SKILL.md:18In the instructionsOpen original file
# Extract structured datafirecrawl agent "extract all pricing tiers" --wait --json -o .firecrawl/pricing.json

It supports both waiting synchronously for results and receiving a job ID for later status checks or cancellation.

View source
SKILL.md:33In the instructionsOpen original file
Omitting `--wait` returns a job ID. A UUID positional argument is auto-detected as a status check:
SKILL.md:39In the instructionsOpen original file
# Wait on an existing job, polling every 10 seconds for up to 5 minutesfirecrawl agent "<job-id>" --wait --poll-interval 10 --timeout 300# Cancel an active jobfirecrawl agent "<job-id>" --cancel```
Start here · InstructionsSKILL.md
firecrawl-agent
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Run commands
SKILL.md:6In the instructionsOpen original file
allowed-tools:  - Bash(firecrawl *)  - Bash(npx firecrawl-cli *)
SKILL.md:7In the instructionsOpen original file
  - Bash(firecrawl *)  - Bash(npx firecrawl-cli *)---
SKILL.md:16In the instructionsOpen original file
```bash# Extract structured data
Install extra software packages
SKILL.md:7In the instructionsOpen original file
  - Bash(firecrawl *)  - Bash(npx firecrawl-cli *)---
Connect to websites
SKILL.md:58In the instructionsOpen original file
- [firecrawl-crawl](../firecrawl-crawl/SKILL.md) — bulk extraction without AI- [firecrawl-build-scrape](https://github.com/firecrawl/skills/tree/main/skills/build/firecrawl-build-scrape) — building structured extraction into an app instead of running it here
Lines read
59
File checksum (to compare versions)
943fb518e50239cb8630cb087143074eb31977636e62ec2999da1f56f7720c29