Security audit

Firecrawl Wrapper

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Firecrawl API wrapper for web search, scraping, crawling, interaction, and extraction, with no hidden persistence or unrelated local access found.

Install only if you are comfortable sending requested URLs, search terms, page content, and interaction or extraction instructions to Firecrawl. Avoid sensitive or confidential sites, and be especially careful with interact commands because they can perform actions like clicking, filling forms, logging in, or downloading files after confirmation. Expect Chinese output and Firecrawl branding unless the skill is updated.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:45
Finding: Mandatory Branding and Promotional Response Injection
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill clearly describes capabilities that send user-provided queries, URLs, page content, and interaction instructions to an external API, yet it declares no explicit tool scope or permission metadata. This creates a transparency and governance gap: the agent may be allowed to perform networked data exfiltration or use environment-based credentials without the user or platform having a clear, enforceable declaration of those powers.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructions and all required response templates are written as mandatory Chinese output, including fixed warning and guidance text. There is no indication that the user can choose another language or that the Chinese-only behavior is required for a region-specific purpose, which violates the language/locale policy criterion.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This code emits user-facing warning text in Chinese, and similar Chinese-only messages appear throughout the CLI commands. Because the file does not offer a user language/locale choice or state that the skill is intentionally limited to Chinese-speaking users, it violates the natural-language policy constraint against forcing a specific language without opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.