Skip to content
skillsafebeta
← Report library
Purpose / Documents

Firecrawl Research Papers Skill Security Audit

What the author says it does (original text)

Find and synthesize research papers, whitepapers, PDFs, technical reports, and academic sources with Firecrawl Research, using semantic paper search, related-paper expansion, and in-body verification over Firecrawl's paper index — largely biomedical and life-science literature from PubMed, bioRxiv, and medRxiv, plus arXiv preprints in CS, physics, and math. Use when the user wants a literature rev

Independent security check

Security risks found

Files checked
1
Risks found
3
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Research topics and query text are sent to the hosted Firecrawl service

Source references: 3
What we found

The Skill requires a Firecrawl API key and makes the hosted service the primary route for discovery and verification. Queries, paper identifiers, verification questions, and scraped URLs may therefore be processed by a third party.

Why this matters

If a topic contains unreleased product plans, patient information, legal matters, or other confidential material, it may leave the user's local environment and become subject to Firecrawl's logging, retention, and access policies. The provided text does not define those boundaries.

The Skill explicitly requires a Firecrawl API key and makes Firecrawl’s tools the primary route for discovery and verification. Using those tools submits research queries, paper IDs, verification questions, or scrape URLs to Firecrawl. This can disclose research interests and query content to a third party, though the evidence does not show local files being uploaded. A user can ask about Firecrawl’s retention, logging, and training policies or restrict sensitive topics and submitted content.

SKILL.md:10In the instructionsOpen original file
  source: https://github.com/firecrawl/firecrawl-workflowsinputs:  - name: FIRECRAWL_API_KEY    description: Firecrawl API key for hosted Firecrawl Research, CLI, MCP, or equivalent tool requests.    required: true---
Show 2 other places
SKILL.md:28In the instructionsOpen original file
Use Firecrawl Research through the CLI, MCP, or equivalent Firecrawl toolsurface as the primary path for paper discovery and verification. Fall back togeneral Firecrawl search and scrape for whitepapers, technical reports,research blogs, leaderboards, or facts outside the paper corpus.
SKILL.md:56In the instructionsOpen original file
  categories, source ids, and dates.- MCP: `firecrawl_research_read_paper(id, question)`  CLI: `firecrawl research read-paper <id> --question <question>`  Verify a specific claim or constraint inside one paper, such as method,  reported score, benchmark, affiliation, comparison, or limitation.- MCP: `firecrawl_search(query)` / `firecrawl_scrape(url)`  CLI: `firecrawl search <query>` / `firecrawl scrape <url>`  Use for web-only context: benchmark leaderboards, rankings, reports,  whitepapers, research blogs, and source pages outside the paper index.
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.Risks found: 1
Medium risk

Fetched papers and web pages are not explicitly isolated as untrusted content

Source references: 2
What we found

The Skill tells the agent to read paper bodies and scrape external pages, but does not say to ignore agent-directed commands found inside those sources. A malicious or compromised page could disguise prompt injection as research content.

Why this matters

If the agent treats source text as workflow instructions, it could leave the research task, misstate conclusions, or—where its permissions allow—invoke other tools or disclose contextual data. Merely retrieving malicious text does not establish that an attack succeeded.

These are active workflow instructions to read paper bodies and scrape external pages, without a stated rule to treat returned content as untrusted data, ignore embedded operational commands, or constrain resulting tool actions. If a paper or page contains agent-directed malicious instructions, the agent could mistake them for workflow commands. This is a plausible risk, not evidence that an attack occurred. Users can require quote-only extraction, prohibit source content from triggering tools or permission changes, and request prompt-injection isolation.

SKILL.md:56In the instructionsOpen original file
  categories, source ids, and dates.- MCP: `firecrawl_research_read_paper(id, question)`  CLI: `firecrawl research read-paper <id> --question <question>`  Verify a specific claim or constraint inside one paper, such as method,  reported score, benchmark, affiliation, comparison, or limitation.- MCP: `firecrawl_search(query)` / `firecrawl_scrape(url)`  CLI: `firecrawl search <query>` / `firecrawl scrape <url>`  Use for web-only context: benchmark leaderboards, rankings, reports,  whitepapers, research blogs, and source pages outside the paper index.
Show 1 other places
SKILL.md:88In the instructionsOpen original file
  read-paper to verify the property.- Superlatives and leaderboards: use general web search or scrape to find the  ranking, then map top entries back to papers with paper search.- Author, organization, venue, date, or methodology constraints: verify with  inspect-paper metadata or read-paper before keeping a candidate.
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
Medium risk

Repeated search and paper expansion can create uncapped API usage

Source references: 5
What we found

For some questions, the workflow calls for multiple query framings, expansion from several seeds, and reseeding from new results, while advising against stopping at one strong hit. It sets no limit on calls, result counts, or cost.

Why this matters

On a metered or quota-limited Firecrawl account, broad topics, high target counts, or parallel research may consume substantial quota and create charges beyond the user's expectation.

The Skill explicitly calls for reframing thin searches and, for enumeration tasks, expanding several seeds and reseeding from newly found papers; its principles also discourage stopping after one hit. Although individual searches support `k`, the workflow sets no overall call, result, budget, or stopping limit, so a metered hosted API could incur unexpectedly high charges. Users can require maximum calls, per-call `k`, total paper count, and a spending cap before execution.

SKILL.md:42In the instructionsOpen original file
- MCP: `firecrawl_research_search_papers(query, k?)`  CLI: `firecrawl research search-papers <query> [--k <number>]`  Semantic search over paper abstracts. Start here for most paper-finding  queries, and retry with alternate framing when results are thin or too  narrow.- MCP: `firecrawl_research_related_papers(seed_ids, intent, mode?, k?)`  CLI: `firecrawl research related-papers <seedIds...> --intent <intent> [--mode <similar|citers|references>] [--k <number>]`  Expand from strong seed papers into similar work, citing papers, or  references. Use this to find the relevant paper family, not just the first  matching result.- MCP: `firecrawl_research_inspect_paper(id)`
Show 4 other places
SKILL.md:82In the instructionsOpen original file
  then expand with related papers and keep close neighbors.- Enumeration queries, such as papers that do a task or benchmark a method:  search multiple framings, expand several strong anchors, and re-seed from  newly found relevant papers.- Papers that use or exhibit a property: start from the defining paper or  strongest anchor, expand via similar, citers, or references, and use  read-paper to verify the property.- Superlatives and leaderboards: use general web search or scrape to find the
SKILL.md:105In the instructionsOpen original file
- When in doubt, include the relevant paper family rather than only the single  best result.- Use related-paper expansion to avoid stopping at one strong hit.- Use read-paper to verify load-bearing constraints, not to summarize every  candidate.- Drop only clearly off-topic papers.
SKILL.md:112In the instructionsOpen original file
## Parallel WorkIf appropriate, use sub-agents or equivalent parallel task runners:- Academic Papers researcher- Biomedical and Life Sciences researcher, for PubMed journal articles and  bioRxiv/medRxiv preprints on a clinical, drug, gene, disease, epidemiology,  or public-health topic- Industry Reports researcher- Technical Articles researcher- Synthesis and citation reviewer
SKILL.md:103In the instructionsOpen original file
Principles:- When in doubt, include the relevant paper family rather than only the single  best result.- Use related-paper expansion to avoid stopping at one strong hit.- Use read-paper to verify load-bearing constraints, not to summarize every  candidate.- Drop only clearly off-topic papers.

Inside this skill

5 instruction sections

The Skill primarily uses Firecrawl's hosted research interface to search, expand, inspect, and read papers, then produce a sourced literature review.

View source
SKILL.md:18In the instructionsOpen original file
Use this to create a sourced literature review.
SKILL.md:28In the instructionsOpen original file
Use Firecrawl Research through the CLI, MCP, or equivalent Firecrawl toolsurface as the primary path for paper discovery and verification. Fall back togeneral Firecrawl search and scrape for whitepapers, technical reports,research blogs, leaderboards, or facts outside the paper corpus.

The Skill requires a Firecrawl API key and permits service calls through MCP, CLI, or an equivalent tool.

View source
SKILL.md:10In the instructionsOpen original file
  source: https://github.com/firecrawl/firecrawl-workflowsinputs:  - name: FIRECRAWL_API_KEY    description: Firecrawl API key for hosted Firecrawl Research, CLI, MCP, or equivalent tool requests.    required: true---

The workflow expands seed papers through similarity, citations, and references, and recommends multiple query framings and repeated expansion for enumeration requests.

View source
SKILL.md:47In the instructionsOpen original file
  narrow.- MCP: `firecrawl_research_related_papers(seed_ids, intent, mode?, k?)`  CLI: `firecrawl research related-papers <seedIds...> --intent <intent> [--mode <similar|citers|references>] [--k <number>]`  Expand from strong seed papers into similar work, citing papers, or  references. Use this to find the relevant paper family, not just the first  matching result.- MCP: `firecrawl_research_inspect_paper(id)`
SKILL.md:82In the instructionsOpen original file
  then expand with related papers and keep close neighbors.- Enumeration queries, such as papers that do a task or benchmark a method:  search multiple framings, expand several strong anchors, and re-seed from  newly found relevant papers.- Papers that use or exhibit a property: start from the defining paper or

The final output is expected to trace major claims to sources and distinguish peer-reviewed work from blogs and vendor reports.

View source
SKILL.md:157In the instructionsOpen original file
## Quality Bar- Every major claim should trace to a source.- Note inaccessible or failed PDFs.- Distinguish peer-reviewed work from blogs and vendor reports.
Start here · InstructionsSKILL.md
firecrawl-research-papers
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Connect to websites
SKILL.md:8In the instructionsOpen original file
  version: "0.1.0"  homepage: https://www.firecrawl.dev  source: https://github.com/firecrawl/firecrawl-workflows
SKILL.md:9In the instructionsOpen original file
  homepage: https://www.firecrawl.dev  source: https://github.com/firecrawl/firecrawl-workflowsinputs:
SKILL.md:12In the instructionsOpen original file
  - name: FIRECRAWL_API_KEY    description: Firecrawl API key for hosted Firecrawl Research, CLI, MCP, or equivalent tool requests.    required: true
Read keys or account settings
SKILL.md:11In the instructionsOpen original file
inputs:  - name: FIRECRAWL_API_KEY    description: Firecrawl API key for hosted Firecrawl Research, CLI, MCP, or equivalent tool requests.
Lines read
162
File checksum (to compare versions)
fa74a2d83b66bea70f38e9e25c0ae7302a59d5b8d37e03c6902866ea8af1b612