Skip to content
skillsafebeta
← Report library
Purpose / Other

Firecrawl Download Skill Security Audit

What the author says it does (original text)

|

Independent security check

Security risks found

Files checked
1
Risks found
3
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

The allowed npx form can obtain and execute an external CLI package

Source references: 3
What we found

The tool permissions include `Bash(npx firecrawl-cli *)`. When the package is not locally cached or version-pinned, npx can retrieve and execute code from the configured package registry; the Skill pins no version and states no source verification.

Why this matters

Execution depends on the package and dependencies served at that time. A malicious or unexpectedly changed release could run with the agent's current permissions and access files, environment variables, and network resources available to that process.

What this evidence establishes

The permission declaration allows `npx firecrawl-cli` without a pinned version, but the complete source contains no step that actually invokes that form; all download examples use `firecrawl`. Permission alone cannot establish that npx will download a package, which registry it would use, or which version it would execute. The user can ask the author to remove the unused npx permission or specify a pinned version and trusted registry.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:5In the instructionsOpen original file
  Save a site or section as local files (markdown, screenshots). Use for "download the site", offline docs, or a local copy for reference.allowed-tools:  - Bash(firecrawl *)  - Bash(npx firecrawl-cli *)---
Show 2 other places
SKILL.md:20In the instructionsOpen original file
```bash# With screenshotsfirecrawl x download https://docs.example.com --screenshot --limit 20 -y
SKILL.md:24In the instructionsOpen original file
# Multiple formats (each saved as its own file per page)firecrawl x download https://docs.example.com --format markdown,links --screenshot --limit 20 -y# Creates per page: index.md + links.txt + screenshot.png
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 2
Medium risk

Automated runs bypass the wizard and may map the whole site origin by default

Source references: 5
What we found

The Skill explicitly requires `-y` for every automated run and says the download first maps the site origin; only an explicit `--include-paths` scopes a non-root URL to one section. Every example also uses `-y`.

Why this matters

If the requested URL scope is ambiguous, the agent could discover and download substantially more pages than expected without interactive confirmation, creating extra requests, local files, service usage, or charges.

The skill explicitly says automated runs use `-y` to bypass the wizard and that downloading first maps the site origin. Without path filtering, it may discover and scrape more pages than the user expects, creating network requests, local files, and authenticated-account usage. An example uses `--limit 20`, but no universal limit is required. The user can require an explicit domain, `--include-paths`, and page limit for every run.

SKILL.md:16In the instructionsOpen original file
Maps the site origin first to discover pages, then scrapes each one into nested directories under `.firecrawl/`. Use `--include-paths` to scope a non-root URL to one section. Automated runs always pass `-y` — without it the command opens an interactive wizard that blocks on a prompt.
Show 4 other places
SKILL.md:22In the instructionsOpen original file
# With screenshotsfirecrawl x download https://docs.example.com --screenshot --limit 20 -y
SKILL.md:29In the instructionsOpen original file
# Filter to specific sectionsfirecrawl x download https://docs.example.com --include-paths "/features,/sdks" -y
SKILL.md:14In the instructionsOpen original file
**Prerequisite:** `download` requires authentication (no keyless free tier); without credentials the CLI prompts an interactive login.
SKILL.md:28In the instructionsOpen original file
# Filter to specific sectionsfirecrawl x download https://docs.example.com --include-paths "/features,/sdks" -y
Low risk

The install command does not pin a dependency version

Source references: 3
What we found

The installation command does not specify dependency versions. The same command may download different code later, so what you install can differ from what was checked.

Why this matters

A later install may download different code even though the command and this report have not changed.

Legitimate use of this code

Line 7 is an allowed-command pattern, not an installation instruction; the active quick-start example invokes an existing `firecrawl` command. The source therefore does not show that the skill installs an unpinned version. If the author intends to use npx later, the user can require a pinned package version and source.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:7In the instructionsOpen original file
  - Bash(firecrawl *)  - Bash(npx firecrawl-cli *)---
Show 2 other places
SKILL.md:5In the instructionsOpen original file
  Save a site or section as local files (markdown, screenshots). Use for "download the site", offline docs, or a local copy for reference.allowed-tools:  - Bash(firecrawl *)  - Bash(npx firecrawl-cli *)---
SKILL.md:20In the instructionsOpen original file
```bash# With screenshotsfirecrawl x download https://docs.example.com --screenshot --limit 20 -y
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

2 instruction sections

The implemented workflow matches the stated purpose: it discovers pages from the target site, scrapes them, and writes Markdown, links, or screenshots under the local `.firecrawl/` directory.

View source
SKILL.md:16In the instructionsOpen original file
Maps the site origin first to discover pages, then scrapes each one into nested directories under `.firecrawl/`. Use `--include-paths` to scope a non-root URL to one section. Automated runs always pass `-y` — without it the command opens an interactive wizard that blocks on a prompt.
SKILL.md:24In the instructionsOpen original file
# Multiple formats (each saved as its own file per page)firecrawl x download https://docs.example.com --format markdown,links --screenshot --limit 20 -y# Creates per page: index.md + links.txt + screenshot.png

The feature requires Firecrawl credentials and starts an interactive login when none are available. The Skill does not instruct the user to provide a key in chat.

View source
SKILL.md:14In the instructionsOpen original file
**Prerequisite:** `download` requires authentication (no keyless free tier); without credentials the CLI prompts an interactive login.

The Skill permits both a directly installed `firecrawl` command and execution through `npx firecrawl-cli`; the latter can involve obtaining and running an npm package, depending on local cache and npm configuration.

View source
SKILL.md:5In the instructionsOpen original file
  Save a site or section as local files (markdown, screenshots). Use for "download the site", offline docs, or a local copy for reference.allowed-tools:  - Bash(firecrawl *)  - Bash(npx firecrawl-cli *)---
Start here · InstructionsSKILL.md
firecrawl-download
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Run commands
SKILL.md:6In the instructionsOpen original file
allowed-tools:  - Bash(firecrawl *)  - Bash(npx firecrawl-cli *)
SKILL.md:7In the instructionsOpen original file
  - Bash(firecrawl *)  - Bash(npx firecrawl-cli *)---
SKILL.md:20In the instructionsOpen original file
```bash# With screenshots
Install extra software packages
SKILL.md:7In the instructionsOpen original file
  - Bash(firecrawl *)  - Bash(npx firecrawl-cli *)---
Read keys or account settings
SKILL.md:14In the instructionsOpen original file
**Prerequisite:** `download` requires authentication (no keyless free tier); without credentials the CLI prompts an interactive login.
Connect to websites
SKILL.md:22In the instructionsOpen original file
# With screenshotsfirecrawl x download https://docs.example.com --screenshot --limit 20 -y
SKILL.md:25In the instructionsOpen original file
# Multiple formats (each saved as its own file per page)firecrawl x download https://docs.example.com --format markdown,links --screenshot --limit 20 -y# Creates per page: index.md + links.txt + screenshot.png
SKILL.md:29In the instructionsOpen original file
# Filter to specific sectionsfirecrawl x download https://docs.example.com --include-paths "/features,/sdks" -y
Lines read
45
File checksum (to compare versions)
efb788d3dd90df376e033bafca7b830eac199daa3ab72edc848dcd9bc061ead2