Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed Firecrawl workflow-routing skill with external web collection expectations, but no hidden code, persistence, or destructive behavior.
Install this if you want Firecrawl-backed web research or structured web-data deliverables. Avoid giving it sensitive internal URLs, private documents, regulated data, or credential-bearing pages unless you are comfortable sending the relevant inputs to Firecrawl and have the needed authorization.
The skill's top-level description is broad enough to match many generic business, marketing, product, or research requests, which can cause over-activation. In practice, that increases the chance that user data or task context is routed into Firecrawl-oriented workflows when a narrower or local-only skill would have been more appropriate.
The skill requires a Firecrawl API key and directs the agent to collect web evidence through Firecrawl, but it does not clearly warn that URLs, topics, search terms, or other task inputs may be sent to an external service. This creates a transparency and data-handling risk, especially when users provide sensitive internal targets, lead lists, research topics, or authenticated documentation sources.
The fallback instruction to use a generic process whenever no existing workflow fits is underspecified and encourages this skill to absorb unrelated requests. That makes accidental invocation more likely and can lead to unnecessary external data transmission, tool use, or expanded task scope beyond what the user intended.
No suspicious patterns detected.
