ClawHub
Back to skill

Security audit

Firecrawler

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Firecrawl web-scraping helper, with normal third-party API and file-output risks that users should understand before use.

Install this only if you are comfortable using Firecrawl as a third-party processor for the URLs, page content, extraction prompts, and screenshots you request. Use a virtual environment, consider pinning the Firecrawl package version, protect your FIRECRAWL_API_KEY, set crawl limits deliberately, and avoid private or authenticated sites unless that data transfer is approved.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:19
Finding

Unpinned Third-Party Dependency Creates a Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 19–22
Vulnerability Type: Unpinned and integrity-unverified package installation
Risk Level: Medium

Vulnerable Code

bash
3. Install the SDK:
   ```bash
   pip3 install firecrawl
   ```

Technical Analysis

The documented installation command retrieves the latest available firecrawl package without an exact version constraint, cryptographic hash, lockfile, or verified package source. Consequently, installation is not reproducible and may silently introduce an incompatible or compromised future release.

This dependency receives the FIRECRAWL_API_KEY when fc.py initializes the Firecrawl client. Python packages may also execute code during installation or import. A malicious package release or compromised distribution channel could therefore execute code with the privileges of the user installing or invoking the Skill and access environment variables, files, and network resources available to that user.

No evidence shows that the current package is malicious. The vulnerability is the absence of controls that bind installation to a reviewed artifact.

Attack Path

  1. An attacker compromises the upstream package, maintainer account, or package distribution channel.
  2. The attacker publishes a malicious release under the expected package name.
  3. A user follows the documented pip3 install firecrawl command.
  4. pip retrieves the malicious or compromised release because no version or hash is specified.
  5. Malicious installation or import-time code executes with the user's privileges.
  6. The code can read FIRECRAWL_API_KEY and other accessible environment variables, inspect user-accessible files, or initiate arbitrary network connections.

Impact Assessment

Successful exploitation could expose the Firecrawl API credential and any other secrets available to the process. It could also permit arbitrary code execution with ...[truncated 250 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the dependency to an exact, reviewed version, such as firecrawl==X.Y.Z.
  • Use a lockfile or hash-locked requirements file with --require-hashes.
  • Verify the official distribution name and trusted package index.
  • Install the dependency in a dedicated virtual environment rather than the global Python environment.
  • Avoid installation with administrator or root privileges.
  • Establish a dependency-update process that reviews release changes before updating the pinned version.
  • Consider automated dependency vulnerability and provenance scanning in CI.

T09 · Insecure Skill Coding Practices

Warning
Location
fc.py:73
Finding

Unvalidated Screenshot URL Enables Arbitrary HTTP Requests from the Local Runtime

Content
View full analysis

Vulnerability Details

File Location: fc.py, lines 73–78
Vulnerability Type: Unrestricted remote URL retrieval and potential server-side request forgery
Risk Level: Medium

Vulnerable Code

python
# Handle URL response (Firecrawl returns hosted URL)
if screenshot_data.startswith("http://") or screenshot_data.startswith("https://"):
    if args.output:
        urllib.request.urlretrieve(screenshot_data, args.output)
        print(f"Screenshot saved to {args.output}")
    else:
        print(f"Screenshot URL: {screenshot_data}")

Technical Analysis

When Firecrawl returns screenshot data as a URL, the program downloads that URL directly with urllib.request.urlretrieve. It validates only that the string begins with http:// or https://. It does not validate the hostname, resolved IP address, redirect destination, response content type, or response size.

The URL is supplied by the remote API or its SDK response rather than directly by the command-line user. Under normal operation, this download is necessary to save a hosted screenshot. However, the implementation gives the upstream response authority to make the local machine contact any HTTP-accessible destination.

If the API, SDK, account, transport path, or returned data is compromised, an attacker could provide a URL targeting localhost, private network ranges, link-local services, or cloud metadata endpoints. Redirects may also bypass an initial hostname check unless every redirect is independently validated. An attacker could additionally return a very large response or non-image content.

The fetched response is written to a user-selected path. The path itself is explicitly supplied by the user, so arbitrary path selection is not independently treated as an attacker-controlled file-write vulnerability in this audit.

Attack Path

  1. A user invokes the screenshot command with an output path.
  2. The Skill submits the requested ...[truncated 1429 chars]
Remediation
View remediation

Remediation Suggestions

  • Require HTTPS and reject plaintext HTTP screenshot URLs.
  • Allowlist the documented Firecrawl screenshot asset domains.
  • Resolve the hostname and reject loopback, private, link-local, multicast, reserved, and unspecified IP ranges for both IPv4 and IPv6.
  • Revalidate DNS results immediately before connection to reduce DNS rebinding risk.
  • Disable automatic redirects or validate the scheme, hostname, and resolved address of every redirect target.
  • Apply strict connection and read timeouts.
  • Stream the response with a maximum byte limit rather than using unrestricted urlretrieve.
  • Verify that the response has an expected image content type and validate the downloaded file as an actual supported image.
  • Write through a securely created temporary file and atomically rename it after validation.
  • If feasible, retrieve screenshot bytes through an authenticated Firecrawl SDK endpoint instead of following an arbitrary response URL.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill clearly relies on environment variables, network access, and writing files via the bundled script, but it does not declare any tool scope or permission boundaries in the skill manifest. This can lead to overbroad execution in agent environments, reducing transparency and making it easier for the skill to access capabilities beyond what a user or platform expects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill instructs users to send arbitrary URLs and page content through the Firecrawl API but does not warn that this data is transmitted to a third-party service. Users may unknowingly submit private URLs, sensitive intranet targets, or confidential page contents, creating privacy, compliance, and data handling risks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.