File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- dist/.setup/firecrawl-fetch-provider-Cq_h8okw.mjs:38
- Evidence
const apiKey = [REDACTED])?.webSearch?.apiKey;
Security audit
OpenClaw Firecrawl Plugin
Security checks for vulnerabilities and agentic risk
Overview
This Firecrawl plugin coherently adds web search and page scraping through Firecrawl with disclosed API key and network behavior.
Install this only if you are comfortable sending web search queries and scraped page URLs/content to Firecrawl or your configured self-hosted Firecrawl endpoint. Treat the Firecrawl API key as sensitive, and disable scrape caching when working with content you do not want stored by the provider.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
Detected: suspicious.exposed_secret_literal