ClawHub
Back to skill

Security audit

seo-firecrawl

Security checks across malware telemetry and agentic risk

Overview

The skill is a straightforward SEO helper for using Firecrawl to crawl, map, scrape, and search sites, with no hidden execution or destructive behavior found.

Before installing, confirm you are comfortable using Firecrawl as an external service for the URLs you provide. Do not crawl or screenshot private, logged-in, internal, staging, customer, paywalled, or regulated-data pages unless you have authorization and have checked Firecrawl retention and privacy terms. Review the separate Firecrawl extension installer before running it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill encourages full-site crawling and content extraction via a third-party service without warning that page contents, metadata, and links may be transmitted off-platform and may include sensitive or non-public information. In an SEO context this is plausible functionality, but the omission can lead users to unknowingly export confidential data from staging sites, internal pages, or customer environments.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The scrape feature supports JavaScript rendering, browser actions, and screenshots, which can capture session-specific content, personal data, paywalled material, or administrative interfaces if used on authenticated pages. Without warnings or safeguards, users may inadvertently collect and transmit sensitive visual or rendered data to the external service.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.