Skip to content
skillsafebeta
← Report library
Purpose / Development

Firecrawl Build Search Skill Security Audit

What the author says it does (original text)

Integrate Firecrawl `/search` into product code and agent workflows. Use when an app needs discovery before extraction, when the feature starts with a query instead of a URL, or when the system should search the web and optionally hydrate result content.

Independent security check

Security risks found

Files checked
1
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Hosted search may disclose user queries to Firecrawl

Source references: 3
What we found

The Skill requires an API key for hosted requests and targets user questions needing current web results. If the product submits the original question to hosted `/search`, the query and usage associated with that key leave the user's environment.

Why this matters

Queries containing customer names, internal projects, unreleased products, or sensitive health or legal topics may be processed under an external service's logging, retention, and access policies.

This is expected search functionality, but it creates a real disclosure boundary: hosted requests require a Firecrawl API key, and the feature searches the current web based on a user's question. A hosted `/search` request necessarily sends the search terms to Firecrawl; if the application forwards the original question, names, internal projects, or other sensitive details could leave the local environment. The source does not establish that Firecrawl retains queries. Users can require redaction, clarify logging/retention, or use a controlled self-hosted endpoint.

SKILL.md:11In the instructionsOpen original file
inputs:  - name: FIRECRAWL_API_KEY    description: Firecrawl API key for hosted Firecrawl requests.    required: true  - name: FIRECRAWL_API_URL    description: Optional base URL for self-hosted Firecrawl deployments.    required: false---
Show 2 other places
SKILL.md:25In the instructionsOpen original file
- the user asks a question and the product must discover sources first- the feature needs current web results- you want to turn a search query into a shortlist of pages for later scraping
SKILL.md:14In the instructionsOpen original file
    required: true  - name: FIRECRAWL_API_URL    description: Optional base URL for self-hosted Firecrawl deployments.    required: false---
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.Risks found: 1
Medium risk

Mandatory mutable documentation extends code-generation control beyond the audited Skill

Source references: 2
What we found

The Skill tells an agent to read several remote pages as the “source of truth” before writing integration code. Those pages are outside the audited material and can change after the Skill is published.

Why this matters

If a page, domain, or publishing pipeline is compromised—or the page contains misleading agent-directed instructions—the agent could add dependencies, network calls, permissions, or credential handling that the user did not review. The supplied evidence does not show that this has happened.

The instruction explicitly requires the agent to read Firecrawl-controlled remote pages before writing code, so integration decisions depend on content outside this audit that can change later. Remote documentation is a legitimate technical source, and the evidence does not show malicious content; the risk is that later changes or compromise could influence generated code. Users can require a pinned snapshot or version, limit retrieval to the applicable language page, and separately review any installation commands, permissions, or credential-handling guidance before use.

SKILL.md:59In the instructionsOpen original file
## Docs (Source of Truth)Read the source-of-truth page for your project language before writing integration code:- **Node / TypeScript**: [docs.firecrawl.dev/agent-source-of-truth/node](https://docs.firecrawl.dev/agent-source-of-truth/node)- **Python**: [docs.firecrawl.dev/agent-source-of-truth/python](https://docs.firecrawl.dev/agent-source-of-truth/python)- **Rust**: [docs.firecrawl.dev/agent-source-of-truth/rust](https://docs.firecrawl.dev/agent-source-of-truth/rust)- **Java**: [docs.firecrawl.dev/agent-source-of-truth/java](https://docs.firecrawl.dev/agent-source-of-truth/java)- **Elixir**: [docs.firecrawl.dev/agent-source-of-truth/elixir](https://docs.firecrawl.dev/agent-source-of-truth/elixir)- **cURL / REST**: [docs.firecrawl.dev/agent-source-of-truth/curl](https://docs.firecrawl.dev/agent-source-of-truth/curl)
Show 1 other places
SKILL.md:63In the instructionsOpen original file
- **Node / TypeScript**: [docs.firecrawl.dev/agent-source-of-truth/node](https://docs.firecrawl.dev/agent-source-of-truth/node)- **Python**: [docs.firecrawl.dev/agent-source-of-truth/python](https://docs.firecrawl.dev/agent-source-of-truth/python)- **Rust**: [docs.firecrawl.dev/agent-source-of-truth/rust](https://docs.firecrawl.dev/agent-source-of-truth/rust)- **Java**: [docs.firecrawl.dev/agent-source-of-truth/java](https://docs.firecrawl.dev/agent-source-of-truth/java)- **Elixir**: [docs.firecrawl.dev/agent-source-of-truth/elixir](https://docs.firecrawl.dev/agent-source-of-truth/elixir)- **cURL / REST**: [docs.firecrawl.dev/agent-source-of-truth/curl](https://docs.firecrawl.dev/agent-source-of-truth/curl)
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

7 instruction sections

The Skill directs an agent to use Firecrawl `/search` to discover, rank, and select web sources from a query, potentially producing URL candidates for later scraping.

View source
SKILL.md:31In the instructionsOpen original file
- Use `/search` first when URL discovery is part of the product behavior.- Keep search and extraction conceptually separate unless scraping search results is clearly required.- Prefer selective follow-up extraction over broad hydration when cost or latency matters.
SKILL.md:55In the instructionsOpen original file
- Treat `/search` as discovery, ranking, and source selection.- Be explicit about whether the product needs snippets, URLs, or full result content.- Keep the query contract stable so downstream scraping logic stays predictable.

Hosted use requires a Firecrawl API key, while a base URL may optionally point to a self-hosted deployment.

View source
SKILL.md:10In the instructionsOpen original file
  source: https://github.com/firecrawl/skillsinputs:  - name: FIRECRAWL_API_KEY    description: Firecrawl API key for hosted Firecrawl requests.    required: true  - name: FIRECRAWL_API_URL    description: Optional base URL for self-hosted Firecrawl deployments.    required: false---

The Skill redirects paper-index, developer-index, known-URL scraping, and interactive-page tasks to adjacent Skills whose implementations are not included in this evidence.

View source
SKILL.md:48In the instructionsOpen original file
- If you already have the URL, use [firecrawl-build-scrape](../firecrawl-build-scrape/SKILL.md).- If the result page then requires clicks or form interaction, escalate to [firecrawl-build-interact](../firecrawl-build-interact/SKILL.md).- If the feature searches **published research papers** — biomedical, clinical, and life-science literature (PubMed, bioRxiv, medRxiv) or arXiv preprints — `/search` is the wrong surface. Use the research paper index instead: [firecrawl-research-index](../firecrawl-research-index/SKILL.md). Passing `categories: ["research"]` to `/search` does **not** query that index; it filters an ordinary web search to research-affiliated websites (the list includes PubMed, bioRxiv, medRxiv, arXiv, and publisher sites) and returns page results from them — no abstract search, related-paper expansion, or full-text passages.- If the feature answers developer questions from issues, pull requests, READMEs, or documentation pages, use the developer index instead: [firecrawl-developer-index](../firecrawl-developer-index/SKILL.md). The same caveat applies to `categories: ["developer"]`.
Start here · InstructionsSKILL.md
firecrawl-build-search
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Connect to websites
SKILL.md:8In the instructionsOpen original file
  version: "0.1.0"  homepage: https://www.firecrawl.dev  source: https://github.com/firecrawl/skills
SKILL.md:9In the instructionsOpen original file
  homepage: https://www.firecrawl.dev  source: https://github.com/firecrawl/skillsinputs:
SKILL.md:12In the instructionsOpen original file
  - name: FIRECRAWL_API_KEY    description: Firecrawl API key for hosted Firecrawl requests.    required: true
Read keys or account settings
SKILL.md:11In the instructionsOpen original file
inputs:  - name: FIRECRAWL_API_KEY    description: Firecrawl API key for hosted Firecrawl requests.
Lines read
77
File checksum (to compare versions)
4bc70dce926e29ae7d3d6769c8f29df6b6e09a8e3b42ceddb39ef142566e906d