Firecrawl Crawl

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:14 AM UTC
• Version: 1.0.0

Overview

The skill’s crawling purpose is clear, but it permits unpinned runtime execution of a third-party npm package through npx.

Review before installing unless you are comfortable with the Firecrawl CLI execution model. Prefer using a preinstalled, reviewed Firecrawl binary or pinning npx to an exact package version, and keep crawls scoped with include paths, depth, and page limits to control cost and data collection.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:7

Finding

Unpinned Runtime Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 7
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code Snippet:

yaml

allowed-tools:
  - Bash(firecrawl *)
  - Bash(npx firecrawl *)

Technical Analysis

The skill permits npx firecrawl to resolve and execute a third-party npm package at runtime without specifying an exact reviewed version or integrity value. When the package is not already installed locally, npx may retrieve executable package content from the configured npm registry.

Because package resolution is mutable, the code executed during a future invocation may differ from the code available when the skill was audited. This creates a supply-chain risk if the package, a transitive dependency, the registry configuration, or the associated publisher account is compromised. Execution is not automatically malicious, but the current configuration lacks controls that ensure the reviewed dependency is the one actually run.

Attack Path

1. An agent invokes the allowed npx firecrawl command while using the skill.
2. npx resolves the unpinned firecrawl package through the configured npm registry or local npm configuration.
3. An attacker who has compromised the package, publisher account, dependency chain, or registry supplies a malicious release.
4. npx downloads and executes that release, including any applicable package lifecycle or command-entry code.
5. The malicious code runs with the operating-system permissions and environment access of the agent process.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the agent's user account. The resulting scope may include access to project files, writable local data, environment variables, network resources, and credentials available to that process. It does not inherently grant administrative privileges; further privilege escalation would depend on se ...[truncated 50 chars]

Remediation

View remediation

Remediation Suggestions

• Remove runtime use of unversioned npx firecrawl.
• Install a reviewed release using an exact version rather than a floating package reference.
• Commit and enforce a lockfile containing integrity hashes, and use deterministic installation such as npm ci.
• Invoke the reviewed local binary directly instead of allowing npx to download missing packages dynamically.
• If npx must be retained, specify an exact version, disable implicit installation where possible, and restrict registry configuration to a trusted source.
• Audit direct and transitive dependencies, monitor publisher and package ownership changes, and use dependency scanning or signature/provenance verification in deployment.
• Run the command in a sandbox with minimal filesystem, environment-variable, credential, and network access.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The manifest references npx firecrawl without a pinned version, creating a supply-chain risk because npx may download and execute whatever version is currently published. In a skill that performs bulk crawling and is likely to be invoked on demand, this increases the chance that unreviewed code is executed in an automated context.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill allows execution via npx firecrawl * without pinning a specific package version, which can cause the latest published package to be fetched and run at execution time. If the upstream package is compromised, typosquatted, or a breaking/malicious release is published, this skill could execute attacker-controlled code in the agent environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.