Skip to content
skillsafebeta
← Report library
Purpose / Other

Firecrawl Crawl Skill Security Audit

What the author says it does (original text)

|

Independent security check

Security risks found

Files checked
1
Risks found
5
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

The permission set allows an unpinned CLI to be run through npx

Source references: 2
What we found

The tool permissions expressly allow `npx firecrawl-cli`. When the package is absent locally, npx can obtain and execute software, but no exact version or source verification is specified; the documented examples only require an installed `firecrawl` command.

Why this matters

If this path is used, the user may execute package code that has changed, been replaced, or has not been reviewed, with the authority of the terminal process.

What this evidence establishes

The allowlist permits commands matching `npx firecrawl-cli` without a pinned version, but permission is not an instruction to execute it. Every visible example invokes `firecrawl`; none invokes npx or supplies an installation step or source verification. An agent could choose the unpinned npx route, but the source does not establish that the Skill actually triggers a download and execution.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:5In the instructionsOpen original file
  Bulk-extract many pages from one site or section. Use for "crawl", "everything under /docs", or content spanning linked pages.allowed-tools:  - Bash(firecrawl *)  - Bash(npx firecrawl-cli *)---
Show 1 other places
SKILL.md:22In the instructionsOpen original file
# Full crawl with depth limitfirecrawl crawl "<url>" --max-depth 3 --wait --progress -o .firecrawl/crawl.json
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Submitted site addresses and crawled content are processed by an authenticated crawling service

Source references: 2
What we found

The Skill uses authenticated Firecrawl operations to extract website content. If the target is internal, unpublished, or contains sensitive URL parameters, the request and returned content leave the local environment for service-side processing.

Why this matters

Private URLs, query parameters, internal site structure, or page content could be disclosed to the third-party service and the associated account.

What this evidence establishes

The source shows that the command crawls a supplied website and requires authentication, but it does not describe deployment, transmitted fields, retention, or access to internal addresses. It confirms that URLs and page content are inputs to crawling, but these lines alone do not establish that sensitive content necessarily leaves the machine or is retained by a third party. Users should confirm the data flow and private-network access first.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:12In the instructionsOpen original file
Bulk extract content from a website. Crawls pages following links up to a depth/limit.**Prerequisite:** `crawl` requires authentication (no keyless free tier); without credentials the CLI prompts an interactive login.
Show 1 other places
SKILL.md:19In the instructionsOpen original file
```bash# Crawl a docs sectionfirecrawl crawl "<url>" --include-paths /docs --limit 50 --wait -o .firecrawl/crawl.json
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 1
Low risk

A fixed output path may replace earlier crawl results

Source references: 4
What we found

Both examples write to the same `.firecrawl/crawl.json` path, without requiring an existence check or a unique filename.

Why this matters

A subsequent crawl may overwrite previously saved results, causing local data loss or mixing up results from different tasks.

What this evidence establishes

Both examples do use the same output path, creating a possible result-file conflict. However, the source does not state whether the CLI overwrites an existing file, refuses to write, or handles it another way, so replacement of prior results is not established. Users can require a pre-run existence check or a unique filename for each crawl.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:20In the instructionsOpen original file
# Crawl a docs sectionfirecrawl crawl "<url>" --include-paths /docs --limit 50 --wait -o .firecrawl/crawl.json
Show 3 other places
SKILL.md:23In the instructionsOpen original file
# Full crawl with depth limitfirecrawl crawl "<url>" --max-depth 3 --wait --progress -o .firecrawl/crawl.json
SKILL.md:19In the instructionsOpen original file
```bash# Crawl a docs sectionfirecrawl crawl "<url>" --include-paths /docs --limit 50 --wait -o .firecrawl/crawl.json# Full crawl with depth limitfirecrawl crawl "<url>" --max-depth 3 --wait --progress -o .firecrawl/crawl.json
SKILL.md:31In the instructionsOpen original file
**Done when:** the crawl reaches a terminal status and the saved output under `.firecrawl/` contains the expected pages.
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Low risk

The install command does not pin a dependency version

Source references: 3
What we found

The installation command does not specify dependency versions. The same command may download different code later, so what you install can differ from what was checked.

Why this matters

A later install may download different code even though the command and this report have not changed.

Legitimate use of this code

Line 7 is not an installation command; it declares permission to invoke commands matching `npx firecrawl-cli`. The actual examples use an installed `firecrawl` command and never instruct the agent to download or install through npx, so the claimed unpinned installation is not active behavior here.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:7In the instructionsOpen original file
  - Bash(firecrawl *)  - Bash(npx firecrawl-cli *)---
Show 2 other places
SKILL.md:5In the instructionsOpen original file
  Bulk-extract many pages from one site or section. Use for "crawl", "everything under /docs", or content spanning linked pages.allowed-tools:  - Bash(firecrawl *)  - Bash(npx firecrawl-cli *)---
SKILL.md:18In the instructionsOpen original file
```bash# Crawl a docs sectionfirecrawl crawl "<url>" --include-paths /docs --limit 50 --wait -o .firecrawl/crawl.json
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
Medium risk

Broad crawls can consume an uncertain amount of paid credits

Source references: 3
What we found

Firecrawl consumes credits per page, while the “full crawl” example limits depth but not the total page count. A link-heavy site can contain many pages even at a shallow depth.

Why this matters

Running the example could consume substantially more account credit than expected, causing charges or exhausting the available quota.

The Skill explicitly says credits are consumed per page. The docs example caps the crawl at 50 pages, but the “full crawl” example visibly limits only depth, not total pages. If an agent follows that example on a densely linked site, credit use may exceed the user's expectation. A user can require `--limit`, `--timeout`, and a credit check before each crawl.

SKILL.md:22In the instructionsOpen original file
# Full crawl with depth limitfirecrawl crawl "<url>" --max-depth 3 --wait --progress -o .firecrawl/crawl.json
Show 2 other places
SKILL.md:37In the instructionsOpen original file
- **Scope crawls with `--include-paths`** whenever the request names a section — crawl only the pages you need.- Crawl consumes credits per page. Check `firecrawl credit-usage` before large crawls (`credit-usage` requires authentication).
SKILL.md:35In the instructionsOpen original file
- Use `--wait` when you need the results immediately. It has no default timeout; use `--timeout <seconds>` to bound polling. Without `--wait`, crawl returns a job ID for async polling.- **Scope crawls with `--include-paths`** whenever the request names a section — crawl only the pages you need.- Crawl consumes credits per page. Check `firecrawl credit-usage` before large crawls (`credit-usage` requires authentication).

Inside this skill

3 instruction sections

The Skill primarily calls Firecrawl to follow site links and extract pages in bulk, then saves the results locally as `.firecrawl/crawl.json`.

View source
SKILL.md:12In the instructionsOpen original file
Bulk extract content from a website. Crawls pages following links up to a depth/limit.**Prerequisite:** `crawl` requires authentication (no keyless free tier); without credentials the CLI prompts an interactive login.
SKILL.md:20In the instructionsOpen original file
# Crawl a docs sectionfirecrawl crawl "<url>" --include-paths /docs --limit 50 --wait -o .firecrawl/crawl.json

The documentation recommends limiting crawls by path and page count, and states that synchronous waiting has no default timeout but can be bounded with `--timeout`.

View source
SKILL.md:35In the instructionsOpen original file
- Use `--wait` when you need the results immediately. It has no default timeout; use `--timeout <seconds>` to bound polling. Without `--wait`, crawl returns a job ID for async polling.- **Scope crawls with `--include-paths`** whenever the request names a section — crawl only the pages you need.- Crawl consumes credits per page. Check `firecrawl credit-usage` before large crawls (`credit-usage` requires authentication).
Start here · InstructionsSKILL.md
firecrawl-crawl
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Run commands
SKILL.md:6In the instructionsOpen original file
allowed-tools:  - Bash(firecrawl *)  - Bash(npx firecrawl-cli *)
SKILL.md:7In the instructionsOpen original file
  - Bash(firecrawl *)  - Bash(npx firecrawl-cli *)---
SKILL.md:18In the instructionsOpen original file
```bash# Crawl a docs section
Install extra software packages
SKILL.md:7In the instructionsOpen original file
  - Bash(firecrawl *)  - Bash(npx firecrawl-cli *)---
Read keys or account settings
SKILL.md:14In the instructionsOpen original file
**Prerequisite:** `crawl` requires authentication (no keyless free tier); without credentials the CLI prompts an interactive login.
Connect to websites
SKILL.md:44In the instructionsOpen original file
- [firecrawl-download](../firecrawl-download/SKILL.md) — download site to local files (uses map + scrape)- [firecrawl-build-scrape](https://github.com/firecrawl/skills/tree/main/skills/build/firecrawl-build-scrape) — building bulk extraction into an app instead of running it here
Lines read
45
File checksum (to compare versions)
f370be1100705d6c2c33ca2b54b861ce6a19a590f93e13e5238a15d2a39929cc