Security audit
Security checks for vulnerabilities and agentic risk
This skill performs web scraping through external tools, but it includes unsafe command examples, under-disclosed third-party data handling, and installation/authentication steps that need careful review.
Install only if you are comfortable sending target URLs and extracted content to Firecrawl and, for the bundled summarize workflow, potentially to AI providers or Apify. Avoid using it on confidential, internal, regulated, or proprietary material unless approved. Do not run the documented batch xargs/sh command on untrusted URL lists, avoid sudo npm install, prefer pinned/local installs, and store API keys in a proper secret manager rather than shell profiles.
SKILL.md:267Shell Command Injection Through Untrusted URL Interpolation
firecrawl-skills/SKILL.md:267Shell Command Injection Through Untrusted URL Interpolation in Mirrored Skill
SKILL.md:32Unpinned Global Installation of Firecrawl CLI
firecrawl-skills/rules/install.md:12Unpinned Firecrawl Dependency and Dynamic npx Execution
summarize/SKILL.md:5Unpinned Third-Party Homebrew Tap for Summarize CLI
firecrawl-skills/rules/install.md:54API Key Exposure Through Command Arguments and Plaintext Shell Profiles
The README materially overstates the skill’s capabilities by presenting it as an AI summarization and report-generation agent rather than a narrower scraping/crawling CLI. This can cause users or upstream agents to invoke the skill for broader autonomous research tasks than intended, increasing the chance of unsafe data handling, unexpected external transmission, or misuse of outputs in automated workflows.
The description omits a user-facing warning that webpage URLs and retrieved content may be transmitted to an external Firecrawl service and possibly processed by related infrastructure. Users may unknowingly send sensitive internal URLs, private documents, or proprietary research targets to a third party, creating confidentiality and compliance risks.
The usage description is broad and action-oriented but does not define clear activation constraints, approval boundaries, or limits on what content may be fetched and processed. In agent environments, this ambiguity can enable over-collection of third-party content or autonomous use beyond user intent, especially when combined with claims of one-click research and report generation.
The skill directs the agent to run firecrawl login --browser, which opens an interactive browser authentication flow and transmits credentials or tokens to an external service. This exceeds passive scraping behavior and can trigger external side effects and account linkage without an explicit user-approved authentication step.
The skill instructs the agent to modify local workspace state by creating a .firecrawl/ directory and editing .gitignore as a default behavior, even though the core purpose is web scraping/search. Unnecessary persistent filesystem changes can affect repositories, alter version-control behavior, and create side effects outside the user’s explicit request.
The skill directs the agent to create a .firecrawl/ directory and modify .gitignore automatically, but it does not require notifying the user or obtaining consent before changing the workspace. Silent filesystem changes can violate user expectations, alter repository state, and potentially hide generated artifacts from version control without explicit approval.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
# Option 1: Fix npm permissions (recommended)
mkdir ~/.npm-global
npm config set prefix '~/.npm-global'
export PATH=~/.npm-global/bin:$PATH
# Add the export to your shell profile
The skill explicitly suggests sudo npm install -g firecrawl-cli, which executes package installation scripts with root privileges. If the package or one of its dependencies is compromised, this can lead to full system compromise, and agent users may copy-paste the command without appreciating the risk despite the 'not recommended' note.
export PATH=~/.npm-global/bin:$PATH
sudo npm install -g firecrawl-cli
This is the same privileged install guidance repeated in the rendered block, again instructing users to run npm as root. Repetition increases the chance an agent or user treats it as an endorsed remediation path, magnifying the risk of arbitrary code execution as root through npm lifecycle scripts.
sudo npm install -g firecrawl-cli
The skill encourages users to summarize URLs, local files, PDFs, images, audio, and YouTube links while documenting multiple external model providers and fallback extractors, but it never warns that submitted content may be transmitted to those third parties. This creates a real confidentiality and privacy risk because users may send sensitive local documents or restricted web content to external services without informed consent.
The skill explicitly advertises optional Firecrawl and Apify integrations for blocked sites and YouTube fallback, but it does not disclose that enabling these services can share fetched content or request metadata with additional third parties. In a scraping/summarization context, this omission is more dangerous because users may assume all processing is local or limited to their selected model provider when in fact extra providers may receive the data.
The documentation recommends automatic browser-based authentication without a clear warning that a browser will open and that authentication data will be exchanged with a third-party service. This weakens informed consent and can surprise users in restricted or sensitive environments.
The authentication guidance instructs running firecrawl login --browser, which automatically opens a browser, without warning the user about this side effect. Unexpected browser launches can disrupt user workflows and may trigger authentication actions or expose session-related behavior without informed consent.