ClawHub
Back to skill

Security audit

Firecrawl Agent

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for Firecrawl-based web extraction, but it permits unpinned runtime execution of the Firecrawl CLI through npx, which should be reviewed before use.

Install only if you are comfortable with Firecrawl CLI access from your agent environment. Prefer a preinstalled, pinned Firecrawl CLI, avoid exposing unnecessary secrets in the environment, use --max-credits for costly runs, and review commands before letting the agent run npx.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:7
Finding

Unpinned Third-Party Package Execution via npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 7
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Complete Code Snippet:

yaml
allowed-tools:
  - Bash(firecrawl *)
  - Bash(npx firecrawl *)

Technical Analysis

The skill authorizes execution of npx firecrawl without specifying an exact package version or requiring dependency-integrity verification. If the package is not already installed locally, npx can retrieve and execute the currently published registry package. Consequently, the effective executable may change after the skill has been reviewed.

This creates a supply-chain trust boundary: compromise of the package, its publisher account, or its distribution channel could cause attacker-controlled code to run when the documented command is invoked. The finding is limited to the unsafe dependency-execution authorization; the audited file does not itself contain a malicious payload.

Attack Path

  1. An attacker compromises the relevant registry package, publisher account, or release process.
  2. A user requests structured website extraction through this skill.
  3. The agent invokes an allowed command matching npx firecrawl *.
  4. If no verified local copy is selected, npx resolves and downloads the current package release.
  5. Package lifecycle or runtime code executes under the agent process's operating-system identity.
  6. The compromised code can access resources available to that identity and tamper with extraction behavior or output.

Impact Assessment

Successful exploitation could execute arbitrary package code with the same privileges as the agent process. The attainable scope may include reading environment variables and accessible local files, modifying writable files, making network requests, consuming service credentials available to the process, or falsifying extraction results. This authorization does not independently grant ...[truncated 106 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove Bash(npx firecrawl *) from the allowed tools when dynamic package execution is unnecessary.
  • Prefer a preinstalled Firecrawl binary obtained from a trusted source and verified before use.
  • If npx is required, pin an audited exact package version rather than resolving the latest release.
  • Lock and verify dependency integrity using trusted hashes or an equivalent immutable installation mechanism.
  • Install dependencies during a controlled build or provisioning phase instead of downloading executable code at runtime.
  • Disable package lifecycle scripts where feasible and enforce an approved package registry.
  • Run the CLI in a sandbox with least-privilege filesystem access, restricted environment variables, and narrowly scoped network access.
  • Periodically review the pinned package version and its transitive dependencies for newly disclosed vulnerabilities.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The manifest references npx firecrawl without version pinning, creating a supply-chain risk at the point the skill declares its executable dependency. If the package or one of its transitive dependencies is replaced or updated maliciously, invoking the skill could run attacker-controlled code.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger phrases are broad enough to match many common requests for extracting products, pricing, or JSON, which increases the chance this powerful autonomous web-navigation skill is invoked unintentionally. In this context, accidental invocation is more dangerous because the skill can browse multi-page sites, consume credits, and send user-provided targets/data into an external extraction workflow.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

The skill allows execution via npx firecrawl * without pinning an exact package version. Because npx resolves and may fetch the latest published package at runtime, a compromised upstream package, malicious new release, or dependency confusion-style event could cause arbitrary code execution in the agent environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.