Firecrawl Web Scraper
v1.0.0Web scraping, crawling, and search via Firecrawl API. Converts web pages to clean markdown/JSON optimized for AI consumption. Use when you need to extract co...
⭐ 0· 241·0 current·0 all-time
byPatrick@moochmaniac
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description align with the code: the Python script talks to api.firecrawl.dev for scrape/crawl/search operations. However the registry metadata declares no required credentials or config paths while both SKILL.md and the script clearly require a Firecrawl API key and reference specific secret file locations (workspace/secrets/firecrawl_api_key, secrets/firecrawl_api_key, and a ~/.openclaw/... path). The missing declaration of that credential/config path is incoherent with the skill's purpose.
Instruction Scope
SKILL.md tells the agent to run scripts/scrape.py for scraping/crawling/searching, which is appropriate. But the runtime instructions and script explicitly look up secret files in 'workspace/secrets/...' and in the user's home directory for an API key. The script will send scraped URLs and related payloads to https://api.firecrawl.dev — expected — but it also reads local filesystem paths for secrets that were not declared in the registry, which broadens the skill's runtime access beyond what the manifest claims.
Install Mechanism
This is instruction-only with an included Python script and no install spec or external downloads. There is no package install or archive extraction. The script depends on the 'requests' module but no installer is invoked by the skill itself.
Credentials
The code requires a Firecrawl API key (it checks FIRECRAWL_API_KEY env var and several secret file paths), yet the registry metadata lists no required environment variables or primary credential. Requesting access to workspace secret file paths and a home-directory path without declaring them is disproportionate to what the manifest states and could unintentionally expose workspace secrets if those files exist.
Persistence & Privilege
The skill is not 'always: true' and does not attempt to modify other skills or system-wide settings. It only reads specified file paths and environment variables at runtime. Autonomous invocation is enabled (default) — expected for skills — but that alone is not flagged.
What to consider before installing
This skill wraps the Firecrawl web-scraping API and will send URLs and scrape requests to https://api.firecrawl.dev, which is expected behaviour. Before installing: (1) verify you trust the publisher and the Firecrawl endpoint; (2) note the skill will look for an API key in FIRECRAWL_API_KEY or in files like workspace/secrets/firecrawl_api_key and a ~/.openclaw/... path — but the registry did not declare these secrets. Prefer providing the API key via an explicitly scoped secret (and avoid placing other sensitive secrets in those file paths); (3) inspect the script (which you've got) to confirm it only sends scrape targets and not arbitrary local files; (4) test with non-sensitive targets and a rotated/test API key to confirm behavior and credits used; (5) ask the publisher to update the manifest to declare the required env var and config paths so the access is transparent. If you can't confirm the publisher or the manifest, treat the skill cautiously and avoid putting production/privileged secrets in the referenced secret files.Like a lobster shell, security has layers — review code before you run it.
latestvk97b569gj929hx1x03xfkpt15s82fdpg
License
MIT-0
Free to use, modify, and redistribute. No attribution required.