Skip to content
Report library
Purpose / Other

Firecrawl Search Skill Security Audit

What the author says it does (original text)

|

Independent security check

Security risks found

Files checked
1
Risks found
4
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 2
Medium risk

The Skill asks to send search judgments and research gaps to Firecrawl by default

Source references: 4
What we found

The completion rule requires feedback after every search. Its payload can include valuable-source URLs, missing topics, and detailed descriptions, potentially revealing what the user is investigating and which needs remain unmet. This is a secondary transmission beyond the search itself and is incentivized with a credit refund. The example also submits it silently in the background, reducing user visibility.

Why this matters

Firecrawl receives judgments and research intent associated with a search ID and team account. If the query concerns an unreleased project, client, vulnerability, or business plan, this supplementary information may be sensitive.

The Skill makes post-search feedback part of its default completion condition and directs submission of structured feedback to Firecrawl. That feedback may include source URLs, missing topics, and descriptions, additionally disclosing what the user is researching and what information they lacked. The example sends it silently in the background, making failures and submission details less visible. An environment-variable opt-out exists; users handling sensitive research can disable feedback beforehand or ask that sending require explicit consent.

SKILL.md:31In the instructionsOpen original file
**Done when:** results are saved under `.firecrawl/`, verified non-empty, processed for the request, and one feedback event is sent within the time window (unless opted out).
Show 3 other places
SKILL.md:43In the instructionsOpen original file
Search costs 2 credits. After you've actually used the results (or decided they were useless), send structured feedback with `firecrawl search-feedback <id>`. The first feedback per search refunds 1 credit and helps us improve search quality. **Do this once per search**, in the background, after you finish processing the results — it does not block your main task.**Opt out:** if `FIRECRAWL_NO_SEARCH_FEEDBACK=1` (or `FIRECRAWL_DISABLE_SEARCH_FEEDBACK=1`) is set, the CLI silently skips the call and never sends anything. Respect that — do not try to work around it. (Team admins can also disable this server-side; the API will return `feedbackErrorCode: "TEAM_OPTED_OUT"` and the CLI will exit 0 silently.)
SKILL.md:66In the instructionsOpen original file
if SEARCH_ID=$(jq -er 'select(any(.data[]; length > 0)) | .id' .firecrawl/search-react-hooks.json); then  firecrawl search-feedback "$SEARCH_ID" \    --rating "<good|partial|bad>" \    --valuable-sources '[{"url":"https://react.dev/reference/react/hooks","reason":"Most authoritative"}]' \    --missing-content '[{"topic":"useDeferredValue","description":"No example of useDeferredValue with Suspense"}]' \    --silent &fi
SKILL.md:81In the instructionsOpen original file
`--silent` suppresses output and `&` runs it in the background so feedback never blocks you.
Medium risk

The example guard can read stale results and submit feedback for the wrong search

Source references: 2
What we found

The documentation acknowledges that a zero-result search may write no file while an earlier file remains. The example merely checks whether that file contains non-empty results and then reads its ID; it does not prove that the file came from the current search. A stale, non-empty file therefore passes the guard.

Why this matters

The agent could attach the current task's rating, sources, or missing topics to an earlier search ID, mixing information across tasks, misattributing it, and corrupting the team's feedback record.

The documentation explicitly says a zero-result search may leave no output or an older file, while the example only checks whether the named file contains any non-empty data before extracting its ID. It does not verify file freshness or that the ID belongs to the just-completed search, so an old non-empty file could cause feedback for the wrong search. This could send inaccurate ratings and research details to Firecrawl. Users can ask for direct propagation of the current search ID or visible confirmation before submission.

SKILL.md:59In the instructionsOpen original file
Verify the search returned results before reading its `id`. Zero-result searches write no output file, so the file may be missing — or left over from an earlier search. The guard below skips feedback when the file is missing or has zero results; call `search-feedback` only inside it:
Show 1 other places
SKILL.md:65In the instructionsOpen original file
# satisfy the substantive-content rule for every rating.if SEARCH_ID=$(jq -er 'select(any(.data[]; length > 0)) | .id' .firecrawl/search-react-hooks.json); then  firecrawl search-feedback "$SEARCH_ID" \    --rating "<good|partial|bad>" \    --valuable-sources '[{"url":"https://react.dev/reference/react/hooks","reason":"Most authoritative"}]' \    --missing-content '[{"topic":"useDeferredValue","description":"No example of useDeferredValue with Suspense"}]' \    --silent &fi```
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Low risk

The install command does not pin a dependency version

Source references: 2
What we found

The installation command does not specify dependency versions. The same command may download different code later, so what you install can differ from what was checked.

Why this matters

A later install may download different code even though the command and this report have not changed.

Legitimate use of this code

Line 7 is an allowed-command pattern, not an installation command. Although `npx firecrawl-cli` can fetch a package temporarily in some environments, this line contains no `install`, version selection, or instruction to execute it, so the claimed unpinned installation is not directly supported. A user can still ask which CLI installation method and versions are expected.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:7In the instructionsOpen original file
  - Bash(firecrawl *)  - Bash(npx firecrawl-cli *)---
Show 1 other places
SKILL.md:5In the instructionsOpen original file
  Web search with full page content. Use when no URL is known: finding sources, articles, or news. For papers use firecrawl-research-index; for library, API, error, or bug questions use firecrawl-developer-index.allowed-tools:  - Bash(firecrawl *)  - Bash(npx firecrawl-cli *)---
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.Risks found: 1
Medium risk

Arbitrary scraped page text enters agent processing without an instruction-isolation rule

Source references: 3
What we found

The `--scrape` option retrieves full content from search-result pages, and the completion rule requires the agent to process those results. Any page can contain text masquerading as system messages, tool commands, or task requirements. The Skill does not state that such text must be handled only as untrusted data.

Why this matters

If the host agent mistakes page text for instructions, a malicious page could influence the answer, induce additional tool actions, or attempt to obtain local data. Success depends on the host's prompt isolation and permissions.

The Skill actively recommends scraping complete page content and requires the results to be processed. Because the sources are ordinary web pages, that content can contain agent-directed pseudo-instructions, while the complete supplied file gives no rule to treat page text strictly as untrusted data. If an agent mistakes such text for task instructions, it could induce extra tool calls, file access, or disclosure. Users can restrict processing to needed facts, disable unnecessary tool permissions, and ask for an explicit rule to ignore instructions embedded in pages.

SKILL.md:20In the instructionsOpen original file
# Search and scrape full page content from resultsfirecrawl search "your query" --scrape -o .firecrawl/scraped.json --json
Show 2 other places
SKILL.md:31In the instructionsOpen original file
**Done when:** results are saved under `.firecrawl/`, verified non-empty, processed for the request, and one feedback event is sent within the time window (unless opted out).
SKILL.md:35In the instructionsOpen original file
- **`--highlights` on by default:** results are query-relevant excerpts, not full-page snippets. Use `--no-highlights` for the original snippets.- **`--scrape` fetches full content** — reuse that content instead of re-scraping result URLs. This saves credits and avoids redundant fetches.- Always write results to `.firecrawl/` with `-o` to avoid context window bloat.
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

4 instruction sections

This Skill performs external web searches through Firecrawl and can additionally scrape the full content of result pages. It saves results as JSON files under the workspace's `.firecrawl/` directory.

View source
SKILL.md:12In the instructionsOpen original file
Web search with optional content scraping. Returns search results as JSON, optionally with full page content.
SKILL.md:18In the instructionsOpen original file
# Basic searchfirecrawl search "your query" -o .firecrawl/result.json --json# Search and scrape full page content from resultsfirecrawl search "your query" --scrape -o .firecrawl/scraped.json --json
SKILL.md:37In the instructionsOpen original file
- **`--scrape` fetches full content** — reuse that content instead of re-scraping result URLs. This saves credits and avoids redundant fetches.- Always write results to `.firecrawl/` with `-o` to avoid context window bloat.- Use `jq` to extract URLs or titles: `jq -r '.data.web[].url' .firecrawl/search.json`

Each search consumes two service credits. Submitting one result-quality feedback event can refund one credit, subject to a daily team refund cap.

View source
SKILL.md:41In the instructionsOpen original file
## Send feedback after every search (refunds 1 credit)Search costs 2 credits. After you've actually used the results (or decided they were useless), send structured feedback with `firecrawl search-feedback <id>`. The first feedback per search refunds 1 credit and helps us improve search quality. **Do this once per search**, in the background, after you finish processing the results — it does not block your main task.
SKILL.md:55In the instructionsOpen original file
  - `bad` → must include `--missing-content` or `--query-suggestions`.- **Daily refund cap (per team, per UTC day, default 100 credits).** Once your team has been refunded 100 credits today, further submissions still record feedback but no longer refund credits. The response includes `creditsRefundedToday` / `dailyRefundCap` / `dailyCapReached`. **When `dailyCapReached: true`, stop calling `search-feedback` for the rest of the UTC day** — it won't refund anything and you're wasting bandwidth.- **Idempotent:** re-submitting for the same search id returns success but no extra refund.

A user or team can disable search feedback through environment variables or a server-side setting, and the Skill explicitly says not to bypass that choice.

View source
SKILL.md:45In the instructionsOpen original file
**Opt out:** if `FIRECRAWL_NO_SEARCH_FEEDBACK=1` (or `FIRECRAWL_DISABLE_SEARCH_FEEDBACK=1`) is set, the CLI silently skips the call and never sends anything. Respect that — do not try to work around it. (Team admins can also disable this server-side; the API will return `feedbackErrorCode: "TEAM_OPTED_OUT"` and the CLI will exit 0 silently.)
Start here · InstructionsSKILL.md
firecrawl-search
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Run commands
SKILL.md:6In the instructionsOpen original file
allowed-tools:  - Bash(firecrawl *)  - Bash(npx firecrawl-cli *)
SKILL.md:7In the instructionsOpen original file
  - Bash(firecrawl *)  - Bash(npx firecrawl-cli *)---
SKILL.md:16In the instructionsOpen original file
```bash# Basic search
Install extra software packages
SKILL.md:7In the instructionsOpen original file
  - Bash(firecrawl *)  - Bash(npx firecrawl-cli *)---
Connect to websites
SKILL.md:68In the instructionsOpen original file
    --rating "<good|partial|bad>" \    --valuable-sources '[{"url":"https://react.dev/reference/react/hooks","reason":"Most authoritative"}]' \    --missing-content '[{"topic":"useDeferredValue","description":"No example of useDeferredValue with Suspense"}]' \
SKILL.md:90In the instructionsOpen original file
- [firecrawl-research-index](../firecrawl-research-index/SKILL.md) — published papers, not `search --categories research`- [firecrawl-build-search](https://github.com/firecrawl/skills/tree/main/skills/build/firecrawl-build-search) — building search into an app instead of running it here
Lines read
91
File checksum (to compare versions)
e19afaf876a365b3109f7f8a68c5f0194bd30ba4c5a3bd54d653b695a17f4c7b