Skip to content
skillsafebeta
← Report library
Purpose / Data analysis

Firecrawl Workflows Skill Security Audit

What the author says it does (original text)

Run outcome-focused Firecrawl workflows that produce deliverables such as research reports, literature reviews over published papers, SEO audits, QA reports, lead lists, knowledge bases, website design systems, and other structured web-data artifacts. Use when the user wants Firecrawl to complete a business, marketing, product, or creative workflow rather than merely scrape a page or integrate API

Independent security check

Security risks found

Files checked
2
Risks found
1
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Sensitive research targets or internal URLs may be sent to hosted Firecrawl

Source references: 5
What we found

The skill tells the agent to infer inputs from the user's message, files, URLs, and context, then collect web evidence through Firecrawl. When the hosted service is used, URLs, search terms, company names, or person targets can leave the local environment.

Why this matters

If a user supplies non-public internal addresses, confidential project names, customer lists, or investigation targets, that information may reach a third-party service. This material does not state its logging, retention, or reuse policy.

The skill explicitly directs the agent to collect web evidence through the Firecrawl CLI or an equivalent tool and declares an API key for hosted requests. It also tells the agent to infer URLs, companies, or topics from the user's request and context. Thus, when hosted Firecrawl is used, research targets, query terms, and crawl URLs may be disclosed to a third party; non-public internal URLs or sensitive targets would create a privacy risk. The source does not direct uploading arbitrary file contents and does not prove any transmission occurred. Users can ask what fields the hosted service receives and retains, and restrict use to approved public URLs, explicit queries, and minimal context.

SKILL.md:11In the instructionsOpen original file
inputs:  - name: FIRECRAWL_API_KEY    description: Firecrawl API key for hosted Firecrawl requests when the workflow runs through the CLI or API.    required: truereferences:
Show 4 other places
SKILL.md:44In the instructionsOpen original file
Infer the workflow, inputs, audience, and output format from the user's request and surrounding context. If enough is clear, start immediately.
SKILL.md:56In the instructionsOpen original file
1. Confirm the workflow and final artifact.2. Collect web evidence with Firecrawl through the CLI or equivalent Firecrawl tool surface.3. Save or cite source evidence so the final claims are traceable.4. Run independent research units in parallel when available.
references/workflow-authoring.md:33In the instructionsOpen original file
Do not run a long interview by default. First infer from the user's message, files, URLs, and surrounding context. If the agent can safely start, start.Ask at most 1-3 concise clarifying questions only when a required input is missing or ambiguity would materially change the work. Prefer defaults for non-blocking choices and state them briefly.
SKILL.md:48In the instructionsOpen original file
- the URL, company, topic, or source to analyze- the desired deliverable or output format- a constraint that would materially change the workflow
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

5 instruction sections

This is a workflow-routing skill. It directs requests to specialized skills for website design, paper research, SEO, lead generation, shopping, and other tasks; if none fits, it uses a generic web-evidence and deliverable process. The referenced sibling skills are not included, so their specific downstream behavior cannot be verified from this material.

View source
SKILL.md:24In the instructionsOpen original file
- Use [firecrawl-website-design-clone](../firecrawl-website-design-clone/SKILL.md) to extract a website's colors, fonts, spacing, components, and layout patterns into an agent-ready `DESIGN.md`.- Use [firecrawl-research-papers](../firecrawl-research-papers/SKILL.md) for literature reviews and paper-backed synthesis, including biomedical, clinical, drug, gene, disease, epidemiology, and public-health topics. It queries Firecrawl's paper index — PubMed, bioRxiv, medRxiv, and arXiv abstracts with full text reachable per paper — rather than searching websites.- Use [firecrawl-deep-research](../firecrawl-deep-research/SKILL.md) for sourced multi-source research reports built from **web** evidence: market, policy, technical, or industry topics. Not for literature reviews — when the evidence base is published papers, use `firecrawl-research-papers` above.- Use [firecrawl-seo-audit](../firecrawl-seo-audit/SKILL.md) for site structure, on-page SEO, keyword, and SERP audits.
SKILL.md:35In the instructionsOpen original file
- Use [firecrawl-knowledge-ingest](../firecrawl-knowledge-ingest/SKILL.md) for auth-gated or JS-heavy docs portal ingestion.- Use [firecrawl-lead-gen](../firecrawl-lead-gen/SKILL.md) for prospect list generation.- Use [firecrawl-market-research](../firecrawl-market-research/SKILL.md) for market, financial, and industry research.- Use [firecrawl-demo-walkthrough](../firecrawl-demo-walkthrough/SKILL.md) for product flow walkthroughs and UX teardown reports.- Use [firecrawl-shop](../firecrawl-shop/SKILL.md) for product research and shopping recommendations.If no existing workflow fits, use this generic process and produce a reusable pattern that could become a new skill.

The generic process calls for network access through the Firecrawl CLI or an equivalent tool, followed by saving or citing source evidence. The skill itself provides no fixed commands, permitted-domain boundary, or output path.

View source
SKILL.md:56In the instructionsOpen original file
1. Confirm the workflow and final artifact.2. Collect web evidence with Firecrawl through the CLI or equivalent Firecrawl tool surface.3. Save or cite source evidence so the final claims are traceable.4. Run independent research units in parallel when available.5. Synthesize findings into the requested deliverable.6. Include a short "rerun inputs" block when the workflow could be automated.

Hosted Firecrawl requests require an API key. The material states its purpose but does not instruct the agent to print it, place it in a report, or pass it to other agents.

View source
SKILL.md:10In the instructionsOpen original file
  source: https://github.com/firecrawl/firecrawl-workflowsinputs:  - name: FIRECRAWL_API_KEY    description: Firecrawl API key for hosted Firecrawl requests when the workflow runs through the CLI or API.    required: truereferences:
Start here · InstructionsSKILL.md
firecrawl-workflows
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.

File reference map

References: 1
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records2 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • references/workflow-authoring.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • references/workflow-authoring.mdSupporting file

Operations mentioned in code and instructions

Connect to websites
SKILL.md:8In the instructionsOpen original file
  version: "0.1.0"  homepage: https://www.firecrawl.dev  source: https://github.com/firecrawl/firecrawl-workflows
SKILL.md:9In the instructionsOpen original file
  homepage: https://www.firecrawl.dev  source: https://github.com/firecrawl/firecrawl-workflowsinputs:
Read keys or account settings
SKILL.md:11In the instructionsOpen original file
inputs:  - name: FIRECRAWL_API_KEY    description: Firecrawl API key for hosted Firecrawl requests when the workflow runs through the CLI or API.
Lines read
145
File checksum (to compare versions)
aed309cfdd77e678c29fe8b0b90198abe787250f038786da378449a7304262e4