Firecrawl Scrape

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:09 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent webpage-scraping helper, but it should go to Review because it allows running an unpinned Firecrawl package through npx.

Install only if you are comfortable with the Firecrawl CLI being executed in your environment. Prefer a pinned, reviewed Firecrawl version or a preinstalled binary, and review scraped `.firecrawl/` files as untrusted content before reusing them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:8

Finding

Unpinned Firecrawl Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 8
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code

yaml

allowed-tools:
  - Bash(firecrawl *)
  - Bash(npx firecrawl *)

Technical Analysis

The skill permits execution of npx firecrawl without specifying an exact package version, integrity hash, or trusted registry. If the package is not already installed locally, npx may resolve, download, and execute the package from the configured registry at runtime.

Consequently, the code executed by this approved command can change after the skill has been audited. Compromise of the package, its publisher account, a transitive dependency, or the package registry and resolution configuration could cause attacker-controlled code to run locally.

Attack Path

1. An attacker compromises the firecrawl package distribution channel, publisher account, dependency chain, or configured package registry.
2. The attacker publishes or serves a malicious package version.
3. The agent invokes the permitted npx firecrawl ... command while fulfilling a scraping request.
4. npx resolves and downloads the unpinned package.
5. Malicious package lifecycle logic or CLI code executes with the permissions and environment available to the agent process.

Impact Assessment

Successful exploitation could permit arbitrary local code execution with the privileges of the account running the agent. Depending on that account's access, the malicious package could read or alter accessible files, inspect environment variables and credentials, make network requests, tamper with generated results, or execute additional processes. No privilege escalation, persistence, or malicious package content is directly demonstrated by the reviewed project; those outcomes would depend on the externally resolved package and runtime environment.

Remediation

View remediation

Remediation Suggestions

• Remove the Bash(npx firecrawl *) allowance and require a preinstalled, reviewed Firecrawl CLI.
• If runtime package resolution is unavoidable, pin an exact audited version rather than resolving the latest release.
• Lock package integrity and restrict resolution to an authenticated, explicitly trusted registry.
• Install dependencies during a controlled build phase using a lockfile and immutable or reproducible artifacts.
• Disable package lifecycle scripts where operationally possible.
• Run the CLI in a sandbox with minimal filesystem, credential, process, and network access.
• Establish dependency monitoring and repeat security review before upgrading the pinned version.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 83% confidence

Finding

The manifest authorizes Bash(npx firecrawl *) without version pinning, so the skill is explicitly permitted to invoke an unpinned remote package. In a skill context, this is especially risky because tool permissions operationalize the command and make accidental or repeated execution of mutable third-party code more likely.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger description uses broad phrases like 'fetch', 'get the page', and 'read this webpage', which can cause the skill to activate in situations beyond the user's intended scope. Over-broad invocation increases the chance of unnecessary network access and writing untrusted remote content to local files, which is more dangerous here because the skill is designed to retrieve arbitrary URLs and persist results.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

Allowing execution via npx firecrawl without a pinned version means the runtime may fetch and execute whatever package version is current at invocation time. That creates a supply-chain risk: a compromised upstream release or unexpected breaking change could lead to arbitrary code execution in the agent environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill examples and guidance show output being written to .firecrawl/ files, but the description does not clearly warn that scraped third-party content will be stored locally. This can lead to unintentional persistence of sensitive, malicious, or policy-restricted content and reduces user/operator awareness about data handling.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.