Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Firecrawl API wrapper for scraping, crawling, and search, with expected third-party network use and API-key access disclosed enough to be understandable.
Install only if you are comfortable sending requested URLs, search terms, crawl scopes, and the Firecrawl API key to Firecrawl. Avoid using it on private intranet URLs, confidential documents, sensitive search terms, or targets you are not authorized to scrape, and monitor credit usage for larger crawls.
The skill advertises commands that use network access and read an API key from local files/environment variables, but it declares no explicit tool scope or permissions boundary. This can cause the hosting agent or user to invoke a capability-bearing skill without clear consent or policy enforcement, increasing the chance of unintended outbound requests and secret use.
The skill sends scraped URLs, search terms, and potentially page contents to the Firecrawl third-party service, but the description does not clearly warn users that their inputs and retrieved data leave the local environment. This creates a real data exposure risk if users submit internal URLs, sensitive queries, or proprietary content under the assumption the operation is local.
This duplicate finding highlights the same outbound scrape request carrying the API key in the Authorization header and user-supplied payload to a third-party API. While HTTPS protects in transit, the operation still expands trust to the external provider and should be treated as a real data-sharing event.
payload["waitFor"] = wait_for
try:
response = requests.post(
"https://api.firecrawl.dev/v1/scrape",
headers={
"Content-Type": "application/json",
This duplicate finding highlights the same outbound scrape request carrying the API key in the Authorization header and user-supplied payload to a third-party API. While HTTPS protects in transit, the operation still expands trust to the external provider and should be treated as a real data-sharing event.
payload["waitFor"] = wait_for
try:
response = requests.post(
"https://api.firecrawl.dev/v1/scrape",
headers={
"Content-Type": "application/json",
The script sends user-supplied URLs and search queries to the external Firecrawl service, along with the bearer API key, but provides no explicit notice or consent mechanism warning that inputs will leave the local environment. In an agent-skill context, users may assume local processing and could unintentionally transmit sensitive internal URLs, query terms, or proprietary targets to a third party.
The hardcoded Firecrawl endpoint confirms that scrape operations always involve a third-party network destination. That is not inherently malicious, but it is a genuine security-relevant external transmission path that matters when users may expect local-only processing.
try:
response = requests.post(
"https://api.firecrawl.dev/v1/scrape",
headers={
"Content-Type": "application/json",
"Authorization": f"Bearer {api_key}"
This duplicate finding captures the same crawl submission, which authorizes with the Firecrawl API key and sends crawl scope data off-system. The agent-skill setting increases risk because users may not realize a third-party service is performing the crawl and receiving the targets.
payload["includePaths"] = include_paths
try:
response = requests.post(
"https://api.firecrawl.dev/v1/crawl",
headers={
"Content-Type": "application/json",
This duplicate finding captures the same crawl submission, which authorizes with the Firecrawl API key and sends crawl scope data off-system. The agent-skill setting increases risk because users may not realize a third-party service is performing the crawl and receiving the targets.
payload["includePaths"] = include_paths
try:
response = requests.post(
"https://api.firecrawl.dev/v1/crawl",
headers={
"Content-Type": "application/json",
The hardcoded crawl endpoint shows that website crawl requests are delegated to Firecrawl rather than executed locally. This is expected for the skill's purpose, but it still creates confidentiality and trust-boundary concerns for submitted domains and crawl scopes.
try:
response = requests.post(
"https://api.firecrawl.dev/v1/crawl",
headers={
"Content-Type": "application/json",
"Authorization": f"Bearer {api_key}"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
try:
response = requests.get(
f"https://api.firecrawl.dev/v1/crawl/{crawl_id}",
headers={"Authorization": f"Bearer {api_key}"},
timeout=30
)
This duplicate finding reflects the same external search request with bearer authentication and a user-supplied query. The main risk is confidentiality of the transmitted query and reliance on an external service boundary, not code execution or injection.
}
try:
response = requests.post(
"https://api.firecrawl.dev/v1/search",
headers={
"Content-Type": "application/json",
This duplicate finding reflects the same external search request with bearer authentication and a user-supplied query. The main risk is confidentiality of the transmitted query and reliance on an external service boundary, not code execution or injection.
}
try:
response = requests.post(
"https://api.firecrawl.dev/v1/search",
headers={
"Content-Type": "application/json",
The hardcoded search endpoint confirms that all search queries are sent to Firecrawl for processing. In this skill context the behavior is expected, but without prominent disclosure it remains a legitimate confidentiality concern because user intent and query content leave the local system.
try:
response = requests.post(
"https://api.firecrawl.dev/v1/search",
headers={
"Content-Type": "application/json",
"Authorization": f"Bearer {api_key}"
The function reads credentials from secret-file locations and from the FIRECRAWL_API_KEY environment variable, but the script provides no visible runtime notice that it is using local credentials. For skills, secret access should be disclosed somewhere user-visible unless already clearly documented elsewhere.
No suspicious patterns detected.