Firecrawl Interact

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:25 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent browser-interaction helper, but it combines authenticated browser control and persistent profiles with broad triggers and an unpinned npx runtime dependency.

Install only if you are comfortable with an agent controlling a live browser. Prefer a pinned or preinstalled Firecrawl CLI, use separate least-privilege browser profiles, avoid saving sessions for sensitive accounts, and require explicit user confirmation before credentials, submissions, purchases, or account changes.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5

Finding

Unpinned Firecrawl Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 5–8
Vulnerability Type: Insecure runtime dependency resolution
Risk Level: Medium

Vulnerable Code

yaml

allowed-tools:
  - Bash(firecrawl *)
  - Bash(npx firecrawl *)

Technical Analysis

The skill explicitly permits npx firecrawl * without pinning an exact package version or verifying package integrity or provenance. When the package is unavailable locally, npx may resolve, download, and execute package code from the configured registry at runtime.

The project contains no package lockfile, integrity hash, version constraint, or registry restriction. Consequently, the code ultimately executed may differ from the code that was originally reviewed. Exploitation would require control or compromise of the resolved package, its publishing account, the configured package registry, or the dependency-resolution environment.

Attack Path

1. An attacker compromises or replaces the package/version resolved for firecrawl, or influences the package registry used by npx.
2. The agent invokes an allowed command such as npx firecrawl scrape ....
3. npx resolves and downloads the unpinned package when no trusted local copy is available.
4. Package installation hooks or CLI entry-point code executes with the permissions of the agent process.
5. Malicious code accesses resources available to that process, potentially including local files, environment variables, credentials, and browser-session information.

Impact Assessment

Successful exploitation could result in arbitrary code execution under the agent process account. The attacker could access or modify files and credentials available to that account, manipulate Firecrawl operations, or expose authenticated browser data. Because the skill documents profiles that persist cookies and localStorage, active authenticated session material may also be at risk when accessible to the compr ...[truncated 253 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the Bash(npx firecrawl *) permission and require a preinstalled, security-reviewed Firecrawl CLI.
2. If npx is required, invoke an exact approved package version rather than an unversioned package name.
3. Commit and enforce a lockfile with integrity metadata, and install dependencies through a trusted, restricted registry.
4. Verify package provenance or signatures where supported and monitor the package and publisher account for compromise.
5. Disable dependency lifecycle scripts where operationally feasible.
6. Execute the CLI in a sandbox with minimal filesystem access, restricted network access, a dedicated low-privilege account, and no unrelated environment secrets.
7. Isolate browser profiles and authenticated session data from package installation and execution contexts.
8. Require explicit review and approval before dependency upgrades.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The manifest references Bash(npx firecrawl *) without a pinned version, creating a supply-chain risk at the tool boundary. Since this skill can drive browser interaction and authenticated sessions, any malicious or unexpected package update could gain broad access to visited content, cookies, and submitted data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad and include common browsing intents like "click," "navigate to," "sign in," and "next page," which can cause this powerful skill to activate in routine contexts. Because the skill can control a live browser, fill forms, and persist session state, over-triggering increases the chance of unintended actions on sensitive sites or data exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly supports login flows, form submission, and persistent profiles, yet it does not prominently warn about handling credentials, cookies, localStorage, or cross-session browser state. In this context, that omission is significant because the tool is designed for authenticated, stateful interaction, which can expose secrets, preserve sensitive sessions, or perform unintended account actions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The skill allows execution via npx firecrawl * without pinning an exact package version. Because npx fetches the latest published package by default, a compromised upstream release or typosquatted package update could change behavior at runtime and introduce supply-chain compromise into agent execution.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.