Skip to content
skillsafebeta
← Report library
Purpose / Other

Firecrawl Interact Skill Security Audit

What the author says it does (original text)

|

Independent security check

Security risks found

Files checked
1
Risks found
4
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

The allowed npx CLI is not pinned to a package version

Source references: 3
What we found

Tool permissions allow any `npx firecrawl-cli` subcommand, but the Skill pins neither a package version nor an integrity digest. If it is not locally cached, npx may resolve and run a current registry release; the supplied text specifies no provenance verification.

Why this matters

If resolution selects a compromised, impersonating, or destructively changed package version, its code may run with the agent process’s privileges and access files, environment variables, and networks available to that process.

What this evidence establishes

The allowed-tools pattern does include `npx firecrawl-cli` without a stated version, but the body never invokes that command and provides no visible installation or package-resolution behavior. A permission declaration alone cannot establish whether a remote package will be downloaded and executed, or whether the environment pins, caches, or wraps it. Users can ask the author to document the source and pin the version and integrity.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:5In the instructionsOpen original file
  Drive a live browser on a scraped page: click, fill forms, log in, paginate, infinite-scroll. Use when content requires interaction or a scrape failed or returned incomplete content.allowed-tools:  - Bash(firecrawl *)  - Bash(npx firecrawl-cli *)---
Show 2 other places
SKILL.md:16In the instructionsOpen original file
```bash# 1. Scrape a page (scrape ID is saved automatically)firecrawl scrape "<url>"
SKILL.md:36In the instructionsOpen original file
Run `firecrawl interact --help` for the full option list.
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 3
Medium risk

Natural-language interaction can perform state-changing actions in authenticated accounts

Source references: 4
What we found

The Skill’s stated capabilities include logging in, clicking, and filling forms, while its completion criterion accepts either captured content or an action result. It does not require renewed confirmation before submitting forms, purchasing, publishing, deleting, or changing account settings, nor does it restrict interaction to read-only actions.

Why this matters

A broad or misunderstood request could cause the browser to activate a submission control and change accounts, orders, or public content under the user’s identity.

The Skill explicitly enables clicking, form filling, and login on live pages, and treats an “action result” as completion. Natural-language instructions could therefore change external state in an authenticated account, while the visible instructions require no confirmation before submission, purchase, posting, deletion, or settings changes. The risk depends on the page and user prompt; users can ask for sensitive-action confirmations and read-only limits.

SKILL.md:4In the instructionsOpen original file
description: |  Drive a live browser on a scraped page: click, fill forms, log in, paginate, infinite-scroll. Use when content requires interaction or a scrape failed or returned incomplete content.allowed-tools:
Show 3 other places
SKILL.md:20In the instructionsOpen original file
# 2. Interact with the page using a positional promptfirecrawl interact "Click the login button"firecrawl interact "Fill in the email field with test@example.com"firecrawl interact "Extract the pricing table"
SKILL.md:38In the instructionsOpen original file
**Done when:** the requested content or action result is captured and the session is stopped with `firecrawl interact stop`.
SKILL.md:12In the instructionsOpen original file
Interact with scraped pages in a live browser session. Scrape a page first, then use natural language prompts or code to click, fill forms, navigate, and extract data. For web searches, use `search` — interact is for acting on a specific page.
Medium risk

Persistent profiles extend the reach of authenticated sessions

Source references: 3
What we found

The documentation instructs the tool to preserve cookies and localStorage and demonstrates later access to an authenticated dashboard with the same profile. A normal reconnect may continue changing the profile; read-only behavior requires the explicit `--no-save-changes` option.

Why this matters

Later interactions able to use that profile may inherit the user’s login authority and read account data or act as the user. Residual state may also leave a later task authenticated when anonymity was expected.

The documentation explicitly says a profile preserves cookies and localStorage across scrapes and demonstrates later access to an authenticated dashboard. This extends the period and scope in which session credentials may be reused by later tasks or the same profile name. `--no-save-changes` only prevents writes to profile state; it does not establish that webpage actions are read-only. Users can request isolated profiles, short retention, and no-save by default.

SKILL.md:42In the instructionsOpen original file
Use `--profile` on the scrape to persist browser state (cookies, localStorage) across scrapes:
Show 2 other places
SKILL.md:45In the instructionsOpen original file
```bash# Session 1: Login and save statefirecrawl scrape "https://app.example.com/login" --profile my-appfirecrawl interact --prompt "Fill in email with user@example.com and click login"# Session 2: Come back authenticatedfirecrawl scrape "https://app.example.com/dashboard" --profile my-appfirecrawl interact --prompt "Extract the dashboard data"```
SKILL.md:54In the instructionsOpen original file
Read-only reconnect (no writes to profile state):```bashfirecrawl scrape "https://app.example.com" --profile my-app --no-save-changes```
Low risk

The install command does not pin a dependency version

Source references: 3
What we found

The installation command does not specify dependency versions. The same command may download different code later, so what you install can differ from what was checked.

Why this matters

A later install may download different code even though the command and this report have not changed.

Legitimate use of this code

Line 7 is not an installation command; it is a command pattern in the allowed-tools list. The actual examples invoke an already available `firecrawl` command. Therefore, the claim that an installation command is unpinned is not supported in context. The pattern has no version, but the source does not show that the Skill installs anything.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:7In the instructionsOpen original file
  - Bash(firecrawl *)  - Bash(npx firecrawl-cli *)---
Show 2 other places
SKILL.md:5In the instructionsOpen original file
  Drive a live browser on a scraped page: click, fill forms, log in, paginate, infinite-scroll. Use when content requires interaction or a scrape failed or returned incomplete content.allowed-tools:  - Bash(firecrawl *)  - Bash(npx firecrawl-cli *)---
SKILL.md:16In the instructionsOpen original file
```bash# 1. Scrape a page (scrape ID is saved automatically)firecrawl scrape "<url>"
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

4 instruction sections

The Skill first scrapes a specified URL through the Firecrawl CLI, then connects to a live browser session to click, fill forms, log in, navigate, and extract data using natural-language prompts or code.

View source
SKILL.md:4In the instructionsOpen original file
description: |  Drive a live browser on a scraped page: click, fill forms, log in, paginate, infinite-scroll. Use when content requires interaction or a scrape failed or returned incomplete content.allowed-tools:  - Bash(firecrawl *)  - Bash(npx firecrawl-cli *)---
SKILL.md:12In the instructionsOpen original file
Interact with scraped pages in a live browser session. Scrape a page first, then use natural language prompts or code to click, fill forms, navigate, and extract data. For web searches, use `search` — interact is for acting on a specific page.

Interaction depends on an ID produced by an earlier scrape; the CLI saves that ID automatically, and the associated session may expire after about ten minutes.

View source
SKILL.md:62In the instructionsOpen original file
- Always scrape first — `interact` requires a scrape ID from a previous `firecrawl scrape` call- The scrape ID is saved automatically, so you can omit `--scrape-id` for subsequent interact calls. Saved sessions may expire after about 10 minutes; re-scrape if the CLI warns that the session is stale- Use `firecrawl interact stop` to free resources when done- For parallel work, scrape multiple pages and interact with each using `--scrape-id`

A named profile preserves cookies and localStorage across scrapes so later sessions can remain authenticated; an explicit read-only reconnect option is also provided to prevent profile changes from being saved.

View source
SKILL.md:42In the instructionsOpen original file
Use `--profile` on the scrape to persist browser state (cookies, localStorage) across scrapes:
SKILL.md:45In the instructionsOpen original file
```bash# Session 1: Login and save statefirecrawl scrape "https://app.example.com/login" --profile my-appfirecrawl interact --prompt "Fill in email with user@example.com and click login"# Session 2: Come back authenticatedfirecrawl scrape "https://app.example.com/dashboard" --profile my-appfirecrawl interact --prompt "Extract the dashboard data"```
SKILL.md:54In the instructionsOpen original file
Read-only reconnect (no writes to profile state):```bashfirecrawl scrape "https://app.example.com" --profile my-app --no-save-changes```
Start here · InstructionsSKILL.md
firecrawl-interact
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Run commands
SKILL.md:6In the instructionsOpen original file
allowed-tools:  - Bash(firecrawl *)  - Bash(npx firecrawl-cli *)
SKILL.md:7In the instructionsOpen original file
  - Bash(firecrawl *)  - Bash(npx firecrawl-cli *)---
SKILL.md:16In the instructionsOpen original file
```bash# 1. Scrape a page (scrape ID is saved automatically)
Install extra software packages
SKILL.md:7In the instructionsOpen original file
  - Bash(firecrawl *)  - Bash(npx firecrawl-cli *)---
Connect to websites
SKILL.md:46In the instructionsOpen original file
# Session 1: Login and save statefirecrawl scrape "https://app.example.com/login" --profile my-appfirecrawl interact --prompt "Fill in email with user@example.com and click login"
SKILL.md:50In the instructionsOpen original file
# Session 2: Come back authenticatedfirecrawl scrape "https://app.example.com/dashboard" --profile my-appfirecrawl interact --prompt "Extract the dashboard data"
SKILL.md:57In the instructionsOpen original file
```bashfirecrawl scrape "https://app.example.com" --profile my-app --no-save-changes```
Lines read
73
File checksum (to compare versions)
ce51b67e3948036aff0b819a540ccdea9ec3a2bfe0b9c8ba119517caa24901c9