Skip to content
skillsafebeta
← Report library
Purpose / Other

Firecrawl Website Design Clone Skill Security Audit

What the author says it does (original text)

Extract any website's design system into an agent-ready DESIGN.md using Firecrawl scrape evidence. Use when the user wants colors, fonts, spacing, components, layout patterns, or brand/UI guidance from a website so AI agents can create new websites, clone a look, or build pages inspired by that design.

Independent security check

Security risks found

Files checked
1
Risks found
3
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

The target URL and page content are processed by hosted Firecrawl

Source references: 3
What we found

The Skill requires a Firecrawl API key for hosted requests and then uses Firecrawl to collect content, images, and a screenshot from the supplied URL. Private URLs, tokens embedded in query parameters, or sensitive page material may therefore be processed by a third party.

Why this matters

The provider may receive the target URL and any page content it can access. Sensitive information could be disclosed if the URL contains secrets or the page was not intended for external processing.

The skill explicitly requires an API key for hosted Firecrawl requests and directs Firecrawl to process the supplied URL for branding, images, and a full-page screenshot. This supports the risk that a third party handles the target URL and returned page data; URLs containing query tokens or authorized pages with sensitive content could create added exposure. The source does not describe private-page authentication, so it does not prove such data will always be sent. Users can restrict use to public URLs without sensitive parameters and ask about Firecrawl retention and access policies.

SKILL.md:10In the instructionsOpen original file
  source: https://github.com/firecrawl/firecrawl-workflowsinputs:  - name: FIRECRAWL_API_KEY    description: Firecrawl API key for hosted Firecrawl requests when the workflow runs through the CLI or API.    required: true---
Show 2 other places
SKILL.md:34In the instructionsOpen original file
Use Firecrawl through the CLI or equivalent tool surface. Always start with two parallel scrapes of the supplied URL:1. The `branding` and `images` formats together for structured design tokens and the full set of page images.2. A full-page screenshot for visual context.
SKILL.md:51In the instructionsOpen original file
Use the structured `branding` output as the primary source for colors, typography, components, brand assets (logo, favicon, ogImage), personality, and confidence notes. Use the `images` list as the source of truth for the page's content imagery — hero photography, product shots, carousels, feature visuals, illustrations, and decorative graphics. Use the screenshot as the primary visual reference for layout, hierarchy, and overall feel. Add supplemental formats only when these are insufficient for the final artifact.
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.Risks found: 1
Medium risk

Scraped webpages can inject instructions into the agent

Source references: 3
What we found

The workflow reads page Markdown, HTML, copy, and links and then produces build instructions for another agent, but it does not require scraped material to be treated strictly as untrusted data. A malicious page can place disguised instructions in visible copy or page structure.

Why this matters

If the agent interprets webpage text as operational instructions, it may act outside the user's goal. The eventual harm depends on the file, network, and execution permissions available to that agent.

The skill feeds visible page content, structure, copy, links, and sometimes HTML into an agent, then produces “build instructions” for another agent to follow. The source does not require scraped text to be treated as untrusted or instructions within it to be ignored. A target page containing disguised commands could therefore influence DESIGN.md or later decisions, depending on the page and host-agent safeguards. Users can ask the author for explicit prompt-injection isolation and restrict HTML/link ingestion and downstream execution.

SKILL.md:22In the instructionsOpen original file
The skill should feel like a thin workflow around Firecrawl scrape: gather the page's visible content, structure, metadata, links, and available visual signals, then synthesize those findings into a clean design-system markdown file.
Show 2 other places
SKILL.md:58In the instructionsOpen original file
- a full-page screenshot saved locally in `.firecrawl/` so it can be embedded in `DESIGN.md`- page markdown for headings, copy hierarchy, CTAs, navigation, and section order when needed- metadata and links for brand, product, and page-purpose clues when needed- HTML only when the branding output, images list, and screenshot are insufficient to infer classes, font names, CSS variables, or component structure- related pages only when the user asks for a broader site system
SKILL.md:126In the instructionsOpen original file
## Agent Build Instructions[Concrete instructions an AI coding agent can follow to create a new site in this style]
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
Low risk

The default workflow consumes Firecrawl account credits

Source references: 3
What we found

The Skill mandates two scrape operations and explicitly says the combined branding-and-images request costs one credit. The full-page screenshot is another required request, but its precise billing is not stated.

Why this matters

Each run consumes quota on the account associated with the API key and may incur charges, especially when repeated or used at scale.

The default workflow explicitly requires two scrapes of the same URL: one for branding plus images and another for a full-page screenshot. It states that the combined branding/images call costs one credit, so running the skill causes at least that disclosed credit usage. Screenshot pricing is not stated, so the total cost cannot be determined from the source. Users can request confirmation of expected request count, screenshot billing, and account budget limits before running it.

SKILL.md:34In the instructionsOpen original file
Use Firecrawl through the CLI or equivalent tool surface. Always start with two parallel scrapes of the supplied URL:1. The `branding` and `images` formats together for structured design tokens and the full set of page images.2. A full-page screenshot for visual context.
Show 2 other places
SKILL.md:47In the instructionsOpen original file
Combining `branding` and `images` in one call still costs a single credit and is required: the `branding` block only surfaces curated brand assets (`logo`, `favicon`, `ogImage`, `logoHref`), so without `images` the agent will miss the page's actual content imagery (heroes, product shots, carousel slides, feature visuals, illustrations, accessory photos, end-of-page artwork, and similar). On a product page like `tesla.com/cybertruck` the `branding` block has no hero — only `images` returns the main Cybertruck hero (e.g. `Cybertruck-Hero-Desktop-NA-SA-APAC.png`) and the rest of the page's photography.
SKILL.md:41In the instructionsOpen original file
```bashfirecrawl scrape "https://example.com" --format branding,images -o ".firecrawl/example-branding.json" --pretty &firecrawl scrape "https://example.com" --full-page-screenshot -o ".firecrawl/example-screenshot.png" &wait```

Inside this skill

6 instruction sections

The Skill directs the agent to scrape a user-supplied URL through the Firecrawl CLI or an equivalent tool, collecting branding/image data and a full-page screenshot.

View source
SKILL.md:34In the instructionsOpen original file
Use Firecrawl through the CLI or equivalent tool surface. Always start with two parallel scrapes of the supplied URL:1. The `branding` and `images` formats together for structured design tokens and the full set of page images.2. A full-page screenshot for visual context.

Scrape results and screenshots are stored under `.firecrawl/`, and the workflow creates or updates `DESIGN.md`; the artifacts are retained for review.

View source
SKILL.md:49In the instructionsOpen original file
If the screenshot scrape returns a remote image URL (e.g. signed storage link) instead of a local file, download it to the same `.firecrawl/` path so `DESIGN.md` can reference a stable local asset.
SKILL.md:88In the instructionsOpen original file
Create or return a `DESIGN.md` with this structure. Embed the full-page screenshot near the top so a coding agent gets visual context alongside the tokens.
SKILL.md:144In the instructionsOpen original file
- Keep the output compact enough that another agent can paste it into context and build from it.- Preserve source URLs and scrape artifacts for review.

The Skill converts observed and inferred design information into design tokens and build instructions, requiring approximate values to be labeled when they cannot be measured exactly.

View source
SKILL.md:78In the instructionsOpen original file
When a value cannot be measured exactly from scrape output, label it as inferred and give a practical approximation.
SKILL.md:126In the instructionsOpen original file
## Agent Build Instructions[Concrete instructions an AI coding agent can follow to create a new site in this style]
Start here · InstructionsSKILL.md
firecrawl-website-design-clone
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Connect to websites
SKILL.md:8In the instructionsOpen original file
  version: "0.1.0"  homepage: https://www.firecrawl.dev  source: https://github.com/firecrawl/firecrawl-workflows
SKILL.md:9In the instructionsOpen original file
  homepage: https://www.firecrawl.dev  source: https://github.com/firecrawl/firecrawl-workflowsinputs:
SKILL.md:42In the instructionsOpen original file
```bashfirecrawl scrape "https://example.com" --format branding,images -o ".firecrawl/example-branding.json" --pretty &firecrawl scrape "https://example.com" --full-page-screenshot -o ".firecrawl/example-screenshot.png" &
Read keys or account settings
SKILL.md:11In the instructionsOpen original file
inputs:  - name: FIRECRAWL_API_KEY    description: Firecrawl API key for hosted Firecrawl requests when the workflow runs through the CLI or API.
Run commands
SKILL.md:41In the instructionsOpen original file
```bashfirecrawl scrape "https://example.com" --format branding,images -o ".firecrawl/example-branding.json" --pretty &
Lines read
145
File checksum (to compare versions)
a87d2130cd0be45cb747702a8075fd9a1fde1f8b5d0798fa161fd2f2758ea1b9