Firecrawl Map

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:15 AM UTC
• Version: 1.0.0

Overview

The skill appears to map website URLs as advertised, but it permits running an unpinned Firecrawl package through npx, so the executed code can change outside the reviewed artifact.

Install only if you are comfortable with the agent running Firecrawl from your environment. Prefer a reviewed, locally installed or version-pinned Firecrawl CLI, and avoid using this skill where unpinned npx execution could access sensitive local files, environment variables, or credentials.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:8

Finding

Unpinned Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 8
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Complete Code Snippet:

yaml

allowed-tools:
  - Bash(firecrawl *)
  - Bash(npx firecrawl *)

Technical Analysis

The skill permits the agent to invoke npx firecrawl without specifying an exact package version, lockfile, integrity hash, or verified package source. If the package is not already available locally, npx may resolve, download, and execute registry-hosted package code at runtime.

Consequently, the code ultimately executed can differ from the code that existed when the skill was audited. A compromised registry account, malicious package replacement, dependency compromise, or unexpected package update could introduce attacker-controlled code into the execution path.

Attack Path

1. The agent selects the permitted npx firecrawl command while fulfilling a site-mapping request.
2. npx attempts to resolve firecrawl using the environment's configured package registry.
3. Because no version or integrity constraint is specified, the resolved package may be a newer, compromised, or otherwise unreviewed release.
4. npx downloads the selected package when it is not installed locally.
5. Package installation hooks or CLI entry-point code execute with the privileges of the agent's operating-system process.
6. Malicious package code can access resources available to that process or manipulate the command's output.

Impact Assessment

Successful exploitation could allow arbitrary code execution with the privileges of the user running the agent. The accessible scope may include readable local files, environment variables, credentials exposed to the process, writable project files, and network resources reachable from the host. The package could also falsify site-mapping results or modify other user-writable data.

This permission does not its ...[truncated 191 chars]

Remediation

View remediation

Remediation Suggestions

• Remove Bash(npx firecrawl *) from the allowed tools and require a separately installed, reviewed Firecrawl CLI.
• If runtime package resolution is necessary, pin an exact trusted package version rather than using an unconstrained package name.
• Enforce package integrity through a lockfile and verified integrity hashes.
• Resolve packages only from an approved registry with appropriate namespace and access controls.
• Disable or restrict dependency lifecycle scripts where operationally possible.
• Execute the CLI in a sandbox with minimal filesystem access, no unnecessary credentials, restricted environment variables, and limited network access.
• Route invocation through a constrained wrapper that validates arguments, output paths, package identity, and version before execution.
• Regularly review and update the pinned dependency through a controlled security-update process.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The manifest metadata references npx firecrawl without a version pin, which creates a supply-chain risk at the trust boundary where the skill declares executable tooling. Because manifests define what the agent may run, an unpinned remote package increases exposure to malicious or unexpected code changes outside the repository's control.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description includes very general activation phrases such as "find the URL for," "what pages are on," and "list all pages," alongside broad conditions like "find where something is on a domain." These phrases overlap with common user requests and the file does not provide clear constraints or negative examples to distinguish when this specific skill should activate versus other web-searching or scraping skills.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The skill allows execution via npx firecrawl * without pinning a specific package version. npx will resolve and run the latest published package by default, so a compromised upstream release, typo-squatted dependency path, or breaking update could introduce arbitrary code execution in the agent environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.