File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- dist/.setup/firecrawl-fetch-provider-CcYAp_u6.mjs:38
- Evidence
const apiKey = [REDACTED])?.webSearch?.apiKey;
Security audit
OpenClaw Firecrawl Plugin
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent Firecrawl web search and scraping plugin that discloses its network and API key use.
Install this only if you are comfortable routing web search and scrape requests, target URLs, and optional Firecrawl API credentials through the Firecrawl service or a configured self-hosted endpoint. Review the cache-related options if scraped content should not be stored by Firecrawl.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
Detected: suspicious.exposed_secret_literal