Skip to content
skillsafebeta
← Report library
Purpose / Development

Firecrawl Build Scrape Skill Security Audit

What the author says it does (original text)

Integrate Firecrawl `/scrape` into product code for single-page extraction. Use when an app already has a URL and needs markdown, HTML, links, screenshots, metadata, or structured page output. Prefer this skill over broader crawl patterns when the feature is page-level.

Independent security check

Security risks found

Files checked
2
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Hosted scraping sends the complete target URL to a third-party service

Source references: 3
What we found

The Skill requires an API key for hosted Firecrawl requests and directs the application to call `/scrape` for an existing URL. If that URL contains signed query parameters, access tokens, internal identifiers, or other secrets, those values are submitted to Firecrawl as part of the target. The supplied instructions do not require sanitizing or restricting URLs first.

Why this matters

Firecrawl and its request logs could receive URL data intended only for the user or application. A token-bearing URL may grant access to private files or account resources.

The Skill's intended operation submits an application-supplied URL to `/scrape`, and hosted Firecrawl requests require an API key. It gives no URL-sanitization rule. If the application supplies a URL containing signed parameters, tokens, or internal identifiers, the hosted service could receive them. The source does not show that any data was actually sent, and the optional self-hosted endpoint changes the recipient. Users can ask for host/scheme allowlists, sensitive-query stripping, and clear hosted-service data-handling terms.

SKILL.md:11In the instructionsOpen original file
inputs:  - name: FIRECRAWL_API_KEY    description: Firecrawl API key for hosted Firecrawl requests.    required: true  - name: FIRECRAWL_API_URL    description: Optional base URL for self-hosted Firecrawl deployments.    required: falsereferences:
Show 2 other places
SKILL.md:23In the instructionsOpen original file
Use this when the application already has the URL and needs content from one page.
references/freshness-and-liveness.md:34In the instructionsOpen original file
- `cachedAt` — ISO timestamp of the reused copy, present on a `"hit"`.- `sourceURL` — the URL you requested.- `url` — the URL the response came from. Differing values mean the request was  redirected. Equal values are not proof that no redirect occurred, because
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.Risks found: 1
Medium risk

Implementation is told to trust runtime-fetched external pages

Source references: 2
What we found

The Skill labels several Firecrawl web pages as the “Source of Truth” and requires the agent to read them before writing code. Their contents are outside the audited source and can change after publication. If a page or its delivery chain is compromised, commands, installation steps, or prompt injection on it could influence generated code or agent actions.

Why this matters

Where an agent treats web text as instructions, changed or malicious content could induce unnecessary software installation, unrelated command execution, environment disclosure, or an integration with broader permissions and data access.

This is an active implementation instruction: before writing code, the agent must read external Firecrawl documentation labeled “Source of Truth.” Consulting official documentation is legitimate, but those pages are outside the audited source and may change. If their content or delivery chain were compromised, they could influence generated code or induce installation commands. Nothing here shows that compromise occurred. Users can require pinned or reviewed documentation and prohibit executing web-provided commands, installing packages, or transmitting credentials without confirmation.

SKILL.md:62In the instructionsOpen original file
## Docs (Source of Truth)Read the source-of-truth page for your project language before writing integration code:- **Node / TypeScript**: [docs.firecrawl.dev/agent-source-of-truth/node](https://docs.firecrawl.dev/agent-source-of-truth/node)- **Python**: [docs.firecrawl.dev/agent-source-of-truth/python](https://docs.firecrawl.dev/agent-source-of-truth/python)
Show 1 other places
SKILL.md:67In the instructionsOpen original file
- **Node / TypeScript**: [docs.firecrawl.dev/agent-source-of-truth/node](https://docs.firecrawl.dev/agent-source-of-truth/node)- **Python**: [docs.firecrawl.dev/agent-source-of-truth/python](https://docs.firecrawl.dev/agent-source-of-truth/python)- **Rust**: [docs.firecrawl.dev/agent-source-of-truth/rust](https://docs.firecrawl.dev/agent-source-of-truth/rust)- **Java**: [docs.firecrawl.dev/agent-source-of-truth/java](https://docs.firecrawl.dev/agent-source-of-truth/java)- **Elixir**: [docs.firecrawl.dev/agent-source-of-truth/elixir](https://docs.firecrawl.dev/agent-source-of-truth/elixir)- **cURL / REST**: [docs.firecrawl.dev/agent-source-of-truth/curl](https://docs.firecrawl.dev/agent-source-of-truth/curl)
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

8 instruction sections

The Skill directs an agent to integrate Firecrawl's single-page `/scrape` operation into product code, extracting Markdown, HTML, links, screenshots, metadata, or structured content from a known URL; hosted requests require a Firecrawl API key.

View source
SKILL.md:3In the instructionsOpen original file
name: firecrawl-build-scrapedescription: Integrate Firecrawl `/scrape` into product code for single-page extraction. Use when an app already has a URL and needs markdown, HTML, links, screenshots, metadata, or structured page output. Prefer this skill over broader crawl patterns when the feature is page-level.license: ISC
SKILL.md:11In the instructionsOpen original file
inputs:  - name: FIRECRAWL_API_KEY    description: Firecrawl API key for hosted Firecrawl requests.    required: true  - name: FIRECRAWL_API_URL

It explains that `/scrape` may return a recently indexed copy and recommends using `maxAge`, `cacheState`, and `cachedAt` to assess freshness. It also states that a successful fetch does not prove that the item described by the page is still active.

View source
SKILL.md:39In the instructionsOpen original file
- Firecrawl reuses recently indexed content, which is what makes repeat reads of the same URL fast. Set `maxAge` (milliseconds) to bound how old a reused copy may be, or `maxAge: 0` to skip index reuse for a freshness-critical read.- Read `metadata.cacheState` and `metadata.cachedAt` to see what you actually got.- A successful scrape reports what the page returned. Whether the thing the page describes is still active is a source-specific judgment your code makes.- See [references/freshness-and-liveness.md](references/freshness-and-liveness.md) for the tradeoff, the metadata, and the decision rule.
references/freshness-and-liveness.md:42In the instructionsOpen original file
Firecrawl supplies page evidence; your application interprets it in its ownterms. `200` plus non-empty content means the fetch succeeded, not that the itemdescribed by the page is still active — plenty of sites serve a full page for aremoved record.

The Skill recommends keeping the integration narrowly scoped and requesting richer outputs such as links, screenshots, or branding data only when the consumer needs them.

View source
SKILL.md:58In the instructionsOpen original file
- Keep the integration narrow: one feature, one URL, one extraction contract.- Treat `/scrape` as the default primitive for downstream LLM or indexing pipelines.- Request richer formats only when the consumer needs them, such as links, screenshots, or branding data.
Start here · InstructionsSKILL.md
firecrawl-build-scrape
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.

File reference map

References: 1
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records2 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • references/freshness-and-liveness.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • references/freshness-and-liveness.mdSupporting file

Operations mentioned in code and instructions

Connect to websites
SKILL.md:8In the instructionsOpen original file
  version: "0.1.0"  homepage: https://www.firecrawl.dev  source: https://github.com/firecrawl/skills
SKILL.md:9In the instructionsOpen original file
  homepage: https://www.firecrawl.dev  source: https://github.com/firecrawl/skillsinputs:
SKILL.md:12In the instructionsOpen original file
  - name: FIRECRAWL_API_KEY    description: Firecrawl API key for hosted Firecrawl requests.    required: true
Read keys or account settings
SKILL.md:11In the instructionsOpen original file
inputs:  - name: FIRECRAWL_API_KEY    description: Firecrawl API key for hosted Firecrawl requests.
Lines read
130
File checksum (to compare versions)
ebb09ece6b658265a23cdfc2f119f1baeb92797b357bb3df141198c6364312e0