ClawHub
Back to skill

Security audit

Firecrawl Wrapper

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed wrapper around Firecrawl that sends user-requested web search, scraping, crawling, extraction, and interaction requests to Firecrawl's API.

Install only if you are comfortable sending requested URLs, search terms, page contents, extraction prompts, and interaction instructions to Firecrawl. Avoid using it on confidential pages or accounts unless you understand the third-party data flow, and review interactive actions before approving them.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill advertises no required permissions, yet its documented behavior clearly involves outbound network access to Firecrawl and optional use of environment variables for API keys. This mismatch can mislead reviewers and users about the skill’s trust boundary, especially because user prompts, URLs, page contents, and interaction instructions are explicitly sent to a third-party API.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.