T09 · Insecure Skill Coding Practices
Error
- Location
references/self_hosting.md:11- Finding
Unauthenticated Firecrawl API Exposed on All Network Interfaces
- Content
View full analysis
- Remediation
View remediation
Security audit
Firecrawl
Security checks for vulnerabilities and agentic risk
Overview
This is a legitimate Firecrawl scraping skill, but it needs review because it documents broad crawling/actions and a self-hosting setup that can expose an unauthenticated API if used as written.
Use this skill only for sites you are authorized to scrape, and assume target URLs and retrieved page content may be sent to Firecrawl. Do not use it on logged-in, internal, personal, or sensitive pages without explicit approval. If self-hosting, do not deploy the provided compose example publicly as written: enable authentication, bind privately or use an authenticated proxy, pin image versions or digests, and set conservative resource and crawl limits.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
references/self_hosting.md:12- Finding
Mutable Latest Container Tags Create Supply-Chain and Deployment Integrity Risk
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill explicitly enables broad web scraping, crawling, and structured extraction from arbitrary websites, but it does not include guardrails about privacy, authorization, terms-of-service compliance, robots.txt considerations, rate limiting, sensitive data handling, or downstream storage/use of scraped content. In an agent setting, this omission can normalize indiscriminate collection of third-party data and cause legal, privacy, or operational harm, especially because the skill also encourages recursive crawling and interactive page actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The reference documents powerful scraping, crawling, mapping, extraction, and interactive browser actions without any warning about privacy, authorization, sensitive-data handling, or side effects on target sites. In a skill intended for agent use, this omission increases the chance that users or downstream agents will perform collection or interaction against third-party sites without validating consent, scope, robots/compliance requirements, or the risk of transmitting captured data to an external service.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ### `/scrape` (POST) Synchronously scrapes a single URL. * **Endpoint:** `https://api.firecrawl.dev/v2/scrape` * **Request Schema:** ```json {
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ### `/scrape` (POST) Synchronously scrapes a single URL. * **Endpoint:** `https://api.firecrawl.dev/v2/scrape` * **Request Schema:** ```json {
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ### `/scrape` (POST) Synchronously scrapes a single URL. * **Endpoint:** `https://api.firecrawl.dev/v2/scrape` * **Request Schema:** ```json {
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ### `/scrape` (POST) Synchronously scrapes a single URL. * **Endpoint:** `https://api.firecrawl.dev/v2/scrape` * **Request Schema:** ```json {
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
The sample self-hosting configuration explicitly disables API authentication with
USE_DB_AUTHENTICATION=false, creating an unsafe default for an internet-exposed deployment. In the context of a scraping/crawling service, unauthenticated access can let arbitrary users submit jobs, consume compute/browser resources, scrape through your infrastructure, and potentially access administrative functionality if other controls are absent.- Content
md - REDIS_URL=redis://redis:6379/0 - REDIS_RATE_LIMIT_URL=redis://redis:6379/1 - PLAYWRIGHT_MICROSERVICE_URL=http://playwright-service:3000/scrape - USE_DB_AUTHENTICATION=false depends_on: - redis - playwright-service
Static analysis
No suspicious patterns detected.