Skip to content
skillsafebeta
← Report library
Purpose / Browser automation

Firecrawl Dashboard Reporting Skill Security Audit

What the author says it does (original text)

Pull metrics from analytics dashboards and internal web tools with Firecrawl browser. Use when the user needs dashboard reporting, cross-platform metric summaries, authenticated analytics extraction, date-range reports, or structured metrics from web dashboards.

Independent security check

Security risks found

Files checked
1
Risks found
1
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Authenticated dashboard data may be processed by hosted Firecrawl and parallel workers

Source references: 5
What we found

The Skill requires an API key for hosted requests, directs the Firecrawl browser to access authenticated dashboards and extract actual numbers and tables, and permits parallel workers to receive metrics and source URLs. Permission to view a dashboard does not necessarily authorize third-party services or additional workers to process its contents.

Why this matters

During execution, internal KPIs, customer or operational tables, dashboard addresses, and exported content could leave the dashboard's original trust boundary and enter Firecrawl or parallel execution environments. The scope depends on which pages, expanded areas, and exports are accessed.

The Skill requires an API key for “hosted Firecrawl requests,” directs the Firecrawl browser to operate authenticated dashboards and read KPI values and tables, and permits splitting work among sub-agents who receive metrics and source URLs. Thus, when hosted or parallel execution is used, dashboard data and URLs may be handled by third-party infrastructure or additional actors. Dashboard access alone does not establish organizational approval for that disclosure. A user can ask the author to document transmission, retention, and sub-agent boundaries and restrict processing to approved sources.

SKILL.md:11In the instructionsOpen original file
inputs:  - name: FIRECRAWL_API_KEY    description: Firecrawl API key for hosted Firecrawl requests.    required: true---
Show 4 other places
SKILL.md:28In the instructionsOpen original file
Use Firecrawl browser for authenticated dashboards and UI interaction:- open each dashboard- set or verify date range- extract visible KPI cards, tables, and labels- click tabs, expand sections, and scroll tables- use export/download buttons only when appropriate and allowed
SKILL.md:40In the instructionsOpen original file
If appropriate, use sub-agents or equivalent parallel task runners. Split by dashboard platform or metric category. Each researcher should return metrics, units, period, source URL, and caveats.
SKILL.md:73In the instructionsOpen original file
- Extract actual numbers, not just chart labels.- Note when a chart cannot be read precisely.- Preserve date ranges and source URLs.
SKILL.md:38In the instructionsOpen original file
## Parallel WorkIf appropriate, use sub-agents or equivalent parallel task runners. Split by dashboard platform or metric category. Each researcher should return metrics, units, period, source URL, and caveats.
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

6 instruction sections

The Skill opens dashboards the user can legitimately access, adjusts the date range, and reads visible KPIs, tables, and labels; it may also click tabs, expand sections, scroll tables, or use export functions.

View source
SKILL.md:18In the instructionsOpen original file
Use this to extract visible metrics from dashboards the user can legitimately access.
SKILL.md:30In the instructionsOpen original file
- open each dashboard- set or verify date range- extract visible KPI cards, tables, and labels- click tabs, expand sections, and scroll tables- use export/download buttons only when appropriate and allowed

It requires a Firecrawl API key and designates the Firecrawl browser for authenticated dashboard access and UI interaction.

View source
SKILL.md:11In the instructionsOpen original file
inputs:  - name: FIRECRAWL_API_KEY    description: Firecrawl API key for hosted Firecrawl requests.    required: true---
SKILL.md:28In the instructionsOpen original file
Use Firecrawl browser for authenticated dashboards and UI interaction:

If login has expired, the Skill directs the agent to ask the user to authenticate again rather than bypass access controls.

View source
SKILL.md:36In the instructionsOpen original file
If login has expired, ask the user to re-authenticate rather than attempting to bypass access controls.

The output retains dashboard URLs, date ranges, metrics, tables, or exports, and the work may be divided among parallel workers by platform or metric category.

View source
SKILL.md:40In the instructionsOpen original file
If appropriate, use sub-agents or equivalent parallel task runners. Split by dashboard platform or metric category. Each researcher should return metrics, units, period, source URL, and caveats.
SKILL.md:69In the instructionsOpen original file
Use `reportedAt`, `dateRange`, `dashboards[]`, `metrics[]`, `tables[]`, `exports[]`, and `summary`.
SKILL.md:75In the instructionsOpen original file
- Note when a chart cannot be read precisely.- Preserve date ranges and source URLs.
Start here · InstructionsSKILL.md
firecrawl-dashboard-reporting
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Connect to websites
SKILL.md:8In the instructionsOpen original file
  version: "0.1.0"  homepage: https://www.firecrawl.dev  source: https://github.com/firecrawl/firecrawl-workflows
SKILL.md:9In the instructionsOpen original file
  homepage: https://www.firecrawl.dev  source: https://github.com/firecrawl/firecrawl-workflowsinputs:
SKILL.md:12In the instructionsOpen original file
  - name: FIRECRAWL_API_KEY    description: Firecrawl API key for hosted Firecrawl requests.    required: true
Read keys or account settings
SKILL.md:11In the instructionsOpen original file
inputs:  - name: FIRECRAWL_API_KEY    description: Firecrawl API key for hosted Firecrawl requests.
Lines read
76
File checksum (to compare versions)
3fb97d91eb3f783a3979daa965565b397ca508845f28f1aa0f14a4b50dbb796d