Skip to content
skillsafebeta
← Report library
Purpose / Data analysis

Firecrawl Market Research Skill Security Audit

What the author says it does (original text)

Extract market, financial, earnings, industry, and company metrics with Firecrawl. Use when the user asks for market research, industry trends, public company data, financial comparisons, earnings research, or structured market reports.

Independent security check

Security risks found

Files checked
1
Risks found
3
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Research targets and scraped content are sent to hosted Firecrawl

Source references: 4
What we found

The Skill explicitly requires an API key for “hosted Firecrawl requests” and directs Firecrawl to search and scrape company, financial, and market material. Requests can reveal which companies, markets, and topics the user is investigating; non-public targets may expose sensitive commercial intent to a third party.

Why this matters

The hosted service may receive query terms, target URLs, and returned content and handle them under its logging, retention, and service terms. Usage is also tied to the user's Firecrawl account.

The Skill requires the user's Firecrawl API key for hosted requests and directs the agent to search and scrape material about the target company or market. Firecrawl may therefore receive the query target, requested data categories, and visited URLs; this could reveal non-public research intent. The source does not indicate that other local files or credentials are sent. A user can ask what request data is transmitted, logged, and retained, or limit use to public research targets.

SKILL.md:10In the instructionsOpen original file
  source: https://github.com/firecrawl/firecrawl-workflowsinputs:  - name: FIRECRAWL_API_KEY    description: Firecrawl API key for hosted Firecrawl requests.    required: true---
Show 3 other places
SKILL.md:28In the instructionsOpen original file
Use Firecrawl search and scrape for market reports, news, investor relations, SEC filings, and company pages. Use browser where charts, tabs, period selectors, or financial portals require interaction.
SKILL.md:11In the instructionsOpen original file
inputs:  - name: FIRECRAWL_API_KEY    description: Firecrawl API key for hosted Firecrawl requests.    required: true---
SKILL.md:22In the instructionsOpen original file
Infer the market/company, data focus, timeframe, and output format from context. If the research target is clear, proceed immediately.
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.Risks found: 1
Medium risk

Scraped pages can introduce malicious instructions into the research workflow

Source references: 2
What we found

The Skill directs the agent to read news, company pages, financial portals, and industry reports without stating that page text must be treated only as untrusted data, not agent instructions. A malicious or compromised page could contain prompt injection intended to alter the research, induce additional navigation, or expose context.

Why this matters

If the agent mistakes page text for instructions, the report could be manipulated or unauthorized browsing and data handling could occur. The supplied text does not establish that such page instructions will necessarily be followed.

What this evidence establishes

The Skill does direct the agent to read several kinds of external webpages, so retrieved text may be untrusted. However, the supplied source contains only workflow instructions and no script or instruction to execute webpage text as agent commands. These lines alone cannot establish that prompt injection could redirect the agent, access other locations, or expose context. A user can ask how retrieved content is isolated from instructions and restrict browsing and scraping to necessary domains.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:28In the instructionsOpen original file
Use Firecrawl search and scrape for market reports, news, investor relations, SEC filings, and company pages. Use browser where charts, tabs, period selectors, or financial portals require interaction.Common sources include company investor relations pages, SEC filings, financial portals, earnings releases, industry reports, and news.
Show 1 other places
SKILL.md:30In the instructionsOpen original file
Common sources include company investor relations pages, SEC filings, financial portals, earnings releases, industry reports, and news.
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
Low risk

Parallel research categories may increase API usage and account charges

Source references: 3
What we found

The Skill permits parallel work across company financials, market metrics, industry trends, news, and source validation, while hosted requests use the user's Firecrawl API key. One research task can therefore generate several groups of search and scrape requests.

Why this matters

On a usage-priced or quota-limited account, parallel collection may consume credits faster or create charges. The provided instructions do not set a request ceiling.

Parallel work is optional (“If appropriate”), but the Skill lists five research categories that may run independently. Because hosted Firecrawl requests are required, one research task could generate multiple searches and scrapes, increasing API usage and possible charges. The source provides no concurrency limit, request budget, pricing, or execution implementation, so the actual cost is unknown. A user can require request and concurrency caps plus a cost warning before execution.

SKILL.md:11In the instructionsOpen original file
inputs:  - name: FIRECRAWL_API_KEY    description: Firecrawl API key for hosted Firecrawl requests.    required: true---
Show 2 other places
SKILL.md:32In the instructionsOpen original file
## Parallel WorkIf appropriate, use sub-agents or equivalent parallel task runners:- company financials- market metrics- industry trends- recent news and analyst commentary- source validation
SKILL.md:34In the instructionsOpen original file
If appropriate, use sub-agents or equivalent parallel task runners:- company financials- market metrics- industry trends- recent news and analyst commentary- source validation

Inside this skill

5 instruction sections

The Skill performs market and financial research by searching and scraping external websites through Firecrawl, with browser interaction for charts or controls when needed.

View source
SKILL.md:28In the instructionsOpen original file
Use Firecrawl search and scrape for market reports, news, investor relations, SEC filings, and company pages. Use browser where charts, tabs, period selectors, or financial portals require interaction.Common sources include company investor relations pages, SEC filings, financial portals, earnings releases, industry reports, and news.

Use of the hosted Firecrawl service requires the user to provide a Firecrawl API key.

View source
SKILL.md:10In the instructionsOpen original file
  source: https://github.com/firecrawl/firecrawl-workflowsinputs:  - name: FIRECRAWL_API_KEY    description: Firecrawl API key for hosted Firecrawl requests.    required: true---

The output template records source URLs and extracted data, plus rerun parameters such as the query, company list, requested data points, and output format.

View source
SKILL.md:59In the instructionsOpen original file
## Sources[URLs and data extracted]## Rerun Inputsworkflow: firecrawl-market-researchquery: [market/company]companies: [list]data_points: [all/financial/metrics/trends]output: [json/markdown]```
Start here · InstructionsSKILL.md
firecrawl-market-research
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Connect to websites
SKILL.md:8In the instructionsOpen original file
  version: "0.1.0"  homepage: https://www.firecrawl.dev  source: https://github.com/firecrawl/firecrawl-workflows
SKILL.md:9In the instructionsOpen original file
  homepage: https://www.firecrawl.dev  source: https://github.com/firecrawl/firecrawl-workflowsinputs:
SKILL.md:12In the instructionsOpen original file
  - name: FIRECRAWL_API_KEY    description: Firecrawl API key for hosted Firecrawl requests.    required: true
Read keys or account settings
SKILL.md:11In the instructionsOpen original file
inputs:  - name: FIRECRAWL_API_KEY    description: Firecrawl API key for hosted Firecrawl requests.
Lines read
76
File checksum (to compare versions)
004fe4be7c0a4c4f38298c09a05f30406b25d58cf37edddfcece6a8ab0d2ddba