Skip to content
skillsafebeta
← Report library
Purpose / Other

Firecrawl Scrape Skill Security Audit

What the author says it does (original text)

|

Independent security check

Security risks found

Files checked
1
Risks found
4
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

The Skill permits execution of an unpinned `npx firecrawl-cli` package

Source references: 3
What we found

Tool permissions allow `npx firecrawl-cli *` without pinning a package version, verifying its source, or requiring a preinstalled copy. If the package is absent locally, npx may obtain and execute whichever package version resolves at that time.

Why this matters

If the package or name resolution is compromised, third-party code could run with the agent process's permissions and access the current workspace and available credentials.

What this evidence establishes

The allowlist permits `npx firecrawl-cli` with arbitrary arguments and does not pin a version in the package name. If an agent actually uses it, `npx` may fetch and execute the resolved package when it is not locally available. However, the body never instructs the agent to use that command and all shown operations use `firecrawl`, so the evidence establishes potential permission, not that download or execution will occur. Users can restrict use to a verified, preinstalled, pinned binary.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:5In the instructionsOpen original file
  Extract a URL's content as clean markdown, including JS-rendered pages. Use whenever the user provides a URL and wants its content; prefer over WebFetch.allowed-tools:  - Bash(firecrawl *)  - Bash(npx firecrawl-cli *)---
Show 2 other places
SKILL.md:14In the instructionsOpen original file
## Quick start```bash# Basic markdown extractionfirecrawl scrape "<url>" -o .firecrawl/page.md
SKILL.md:36In the instructionsOpen original file
Run `firecrawl scrape --help` for the full option list.
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Full URLs and query text may be sent to an external scraping service

Source references: 4
What we found

The instructions pass the user-supplied URL directly to Firecrawl and can submit a natural-language question with the request. URL parameters may contain signatures, access tokens, internal hostnames, or other secrets; the question may also contain confidential business information.

Why this matters

For private, presigned, or credential-bearing URLs, the external service may receive the address and content it can access. With `--query`, it may also receive the question text.

The examples pass the complete URL to Firecrawl, and the optional `--query` mode also submits a natural-language question. If a URL contains signed parameters, tokens, or an internal address—or the question contains confidential details—that data leaves the local environment when the external scraping function is invoked. This applies only when those commands are run, and query mode is optional; users can require URL redaction and prohibit `--query`.

SKILL.md:18In the instructionsOpen original file
# Basic markdown extractionfirecrawl scrape "<url>" -o .firecrawl/page.md
Show 3 other places
SKILL.md:32In the instructionsOpen original file
# Ask a question about the pagefirecrawl scrape "https://example.com/pricing" --query "What is the enterprise plan price?"```
SKILL.md:42In the instructionsOpen original file
- **Prefer plain scrape over `--query`.** Scrape to a file, then use `grep`, `head`, or read the markdown directly — you can search and reason over the full content yourself. Use `--query` only when you want a single targeted answer without saving the page (costs 5 extra credits).- **Scrape handles static pages and JS-rendered SPAs.** Escalate to `interact` when the page needs interaction (clicks, form fills, pagination) or scrape misses content.
SKILL.md:17In the instructionsOpen original file
```bash# Basic markdown extractionfirecrawl scrape "<url>" -o .firecrawl/page.md
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Low risk

The install command does not pin a dependency version

Source references: 3
What we found

The installation command does not specify dependency versions. The same command may download different code later, so what you install can differ from what was checked.

Why this matters

A later install may download different code even though the command and this report have not changed.

What this evidence establishes

This is a tool permission, not an installation step; every command example in the body uses `firecrawl scrape`, with no instruction to run `npx` or install a dependency. The cited line therefore does not establish that an unpinned package will be downloaded. If the agent does choose the permitted `npx firecrawl-cli` command, however, this file does not constrain its version or source; users can require a preinstalled, pinned CLI.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:7In the instructionsOpen original file
  - Bash(firecrawl *)  - Bash(npx firecrawl-cli *)---
Show 2 other places
SKILL.md:5In the instructionsOpen original file
  Extract a URL's content as clean markdown, including JS-rendered pages. Use whenever the user provides a URL and wants its content; prefer over WebFetch.allowed-tools:  - Bash(firecrawl *)  - Bash(npx firecrawl-cli *)---
SKILL.md:16In the instructionsOpen original file
```bash# Basic markdown extractionfirecrawl scrape "<url>" -o .firecrawl/page.md
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.Risks found: 1
Medium risk

Prompt injection in scraped pages may influence later agent actions or answers

Source references: 3
What we found

The Skill tells the agent to read and reason over page content but does not require treating that content as untrusted data. A malicious page can embed fake “system instructions,” secret requests, or action commands in text that is prepared for LLM consumption.

Why this matters

The agent could accept page-supplied instructions, give misleading answers, or perform unrelated actions within its existing permissions.

The Skill explicitly tells the agent to read scraped page Markdown and reason over it, while the visible instructions do not say to treat page content as untrusted input. If a page embeds fake instructions, they could influence the agent while it reads or searches the content, potentially leading to unauthorized actions or disclosure; impact still depends on the agent mistakenly following them. Users can require page text to be isolated and forbid tool calls or secret access based on webpage instructions.

SKILL.md:12In the instructionsOpen original file
Scrape one or more URLs. Returns clean, LLM-optimized markdown. Multiple URLs are scraped concurrently.
Show 2 other places
SKILL.md:38In the instructionsOpen original file
**Done when:** you have the scraped content — on stdout, in your `-o` file, or under `.firecrawl/` for multi-URL scrapes — and have inspected it with bounded reads (`head`, `grep`) to answer the request.
SKILL.md:42In the instructionsOpen original file
- **Prefer plain scrape over `--query`.** Scrape to a file, then use `grep`, `head`, or read the markdown directly — you can search and reason over the full content yourself. Use `--query` only when you want a single targeted answer without saving the page (costs 5 extra credits).- **Scrape handles static pages and JS-rendered SPAs.** Escalate to `interact` when the page needs interaction (clicks, form fills, pagination) or scrape misses content.
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

3 instruction sections

This Skill directs the agent to use the Firecrawl CLI to scrape one or more URLs, optionally wait for JavaScript rendering, extract main content or links, ask a question about a page, and write results under `.firecrawl/` or to stdout.

View source
SKILL.md:12In the instructionsOpen original file
Scrape one or more URLs. Returns clean, LLM-optimized markdown. Multiple URLs are scraped concurrently.
SKILL.md:18In the instructionsOpen original file
# Basic markdown extractionfirecrawl scrape "<url>" -o .firecrawl/page.md# Main content only, no nav/footerfirecrawl scrape "<url>" --only-main-content -o .firecrawl/page.md# Wait for JS to render, then scrapefirecrawl scrape "<url>" --wait-for 3000 -o .firecrawl/page.md
SKILL.md:38In the instructionsOpen original file
**Done when:** you have the scraped content — on stdout, in your `-o` file, or under `.firecrawl/` for multi-URL scrapes — and have inspected it with bounded reads (`head`, `grep`) to answer the request.
Start here · InstructionsSKILL.md
firecrawl-scrape
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Run commands
SKILL.md:6In the instructionsOpen original file
allowed-tools:  - Bash(firecrawl *)  - Bash(npx firecrawl-cli *)
SKILL.md:7In the instructionsOpen original file
  - Bash(firecrawl *)  - Bash(npx firecrawl-cli *)---
SKILL.md:16In the instructionsOpen original file
```bash# Basic markdown extraction
Install extra software packages
SKILL.md:7In the instructionsOpen original file
  - Bash(firecrawl *)  - Bash(npx firecrawl-cli *)---
Connect to websites
SKILL.md:27In the instructionsOpen original file
# Multiple URLs (markdown only; each saved to .firecrawl/; -o is ignored)firecrawl scrape https://example.com https://example.com/blog https://example.com/docs
SKILL.md:33In the instructionsOpen original file
# Ask a question about the pagefirecrawl scrape "https://example.com/pricing" --query "What is the enterprise plan price?"```
SKILL.md:54In the instructionsOpen original file
- [firecrawl-download](../firecrawl-download/SKILL.md) — bulk download an entire site to local files- [firecrawl-build-scrape](https://github.com/firecrawl/skills/tree/main/skills/build/firecrawl-build-scrape) — building scrape into an app instead of running it here
Lines read
55
File checksum (to compare versions)
ad2c78ebb4de04a707af438efeecf5dc8dc08a8ab84b445bbaea31188f6acee7