Skills enact-firecrawl
📦

enact-firecrawl

v1.2.1 Content revision r1 High Risk 🌐 Network access🔑 Env variables⚙️ External commands

Extract Web Data with Firecrawl

Web content is often hard to collect in a clean format for AI workflows. This skill uses Firecrawl to scrape, crawl, map, search, and extract structured website data.

Supports: Claude Codex Code(CC)
⚠️ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "enact-firecrawl" from https://skillstore.io/skills/enactprotocol-enact-firecrawl.md and its manifest at https://skillstore.io/api/skills/enactprotocol-enact-firecrawl/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/enactprotocol-enact-firecrawl.md Signed manifest GET /api/skills/enactprotocol-enact-firecrawl/manifest Signed lockfile GET /api/skills/enactprotocol-enact-firecrawl/lockfile

Test it

Using "enact-firecrawl". Scrape a product page and return markdown.

Expected outcome:

The result includes a success flag, the scrape action, the source URL, markdown page content, and available metadata.

Using "enact-firecrawl". Map a documentation website for API reference pages.

Expected outcome:

  • A list of discovered URLs is returned.
  • Relevant links can be filtered before deeper crawling.
  • No full page content is collected during mapping.

Using "enact-firecrawl". Extract pricing plan names and prices from a public pricing page.

Expected outcome:

The result contains structured extracted fields when Firecrawl can identify the requested data.

Security Audit

High Risk
v5 • 7/9/2026 Open versioned report

The skill is a transparent Firecrawl API wrapper with expected network access and a required API-key secret. Most high static key findings are false positives from legitimate secret handling, but screenshot capture and templated command argument interpolation create privacy and injection concerns that should be addressed before broad marketplace publication.

2
Files scanned
475
Lines analyzed
9
Review items
0
False positives ignored

Confirmed security concerns (2)

High
SKILL.md:225
Screen capture upload
- Screenshot capture
The skill documents screenshot capture as a Firecrawl feature and the input formats allow screenshot requests. This can send visual page content to a third-party service, so it is a real privacy-sensitive capability.
High
SKILL.md:17
Potential command argument injection through templated command
The skill command interpolates user-controlled fields such as url, prompt, and schema directly into the command string. If the Enact runtime evaluates this through a shell rather than safely passing argv, crafted input could alter command execution.
The interpolation is visible in the command declaration, but exploitability depends on Enact runtime escaping semantics. The risk is material enough to flag because several interpolated fields accept arbitrary user text.
Capability review items (9)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Low
firecrawl.py:23
Python HTTP libraries
response = requests.post(
The code makes intentional outbound requests to the Firecrawl API. This is expected for the skill, but it is still real network access that sends user-supplied URLs or queries to a third party.
Low
firecrawl.py:42
Python HTTP libraries
response = requests.post(
The code makes intentional outbound requests to the Firecrawl API. This is expected for the skill, but it is still real network access that sends user-supplied URLs or queries to a third party.
Low
firecrawl.py:69
Python HTTP libraries
status_response = requests.get(
The code makes intentional outbound requests to the Firecrawl API. This is expected for the skill, but it is still real network access that sends user-supplied URLs or queries to a third party.
Low
firecrawl.py:92
Python HTTP libraries
response = requests.post(
The code makes intentional outbound requests to the Firecrawl API. This is expected for the skill, but it is still real network access that sends user-supplied URLs or queries to a third party.
Low
firecrawl.py:106
Python HTTP libraries
response = requests.post(
The code makes intentional outbound requests to the Firecrawl API. This is expected for the skill, but it is still real network access that sends user-supplied URLs or queries to a third party.
Low
firecrawl.py:137
Python HTTP libraries
response = requests.post(
The code makes intentional outbound requests to the Firecrawl API. This is expected for the skill, but it is still real network access that sends user-supplied URLs or queries to a third party.
Low
firecrawl.py:159
Python HTTP libraries
status_response = requests.get(
The code makes intentional outbound requests to the Firecrawl API. This is expected for the skill, but it is still real network access that sends user-supplied URLs or queries to a third party.
Low
firecrawl.py:10
Hardcoded URL
API_BASE = "https://api.firecrawl.dev/v1"
The code makes intentional outbound requests to the Firecrawl API. This is expected for the skill, but it is still real network access that sends user-supplied URLs or queries to a third party.
Low
firecrawl.py:15
Python environment access
api_key = os.environ.get("FIRECRAWL_API_KEY")
The tool reads FIRECRAWL_API_KEY from the environment. This is necessary secret access for the API client and should remain visible as a real environment-access risk.

Risk Factors

🌐 Network access (20)
firecrawl.py:23 firecrawl.py:42 firecrawl.py:69 firecrawl.py:92 firecrawl.py:106 firecrawl.py:137 firecrawl.py:159 firecrawl.py:230 firecrawl.py:10 SKILL.md:106 SKILL.md:110 SKILL.md:115 SKILL.md:124 SKILL.md:132 SKILL.md:144 SKILL.md:158 SKILL.md:163 SKILL.md:168 SKILL.md:178 SKILL.md:184
🔑 Env variables (26)
firecrawl.py:15 firecrawl.py:13 firecrawl.py:15 firecrawl.py:16 firecrawl.py:17 firecrawl.py:18 firecrawl.py:21 firecrawl.py:26 firecrawl.py:39 firecrawl.py:45 firecrawl.py:71 firecrawl.py:86 firecrawl.py:95 firecrawl.py:104 firecrawl.py:109 firecrawl.py:121 firecrawl.py:140 firecrawl.py:161 firecrawl.py:196 firecrawl.py:203 firecrawl.py:205 firecrawl.py:208 firecrawl.py:210 firecrawl.py:212 SKILL.md:13 SKILL.md:147
⚙️ External commands (20)
SKILL.md:146-148 SKILL.md:148-157 SKILL.md:157-159 SKILL.md:159-162 SKILL.md:162-164 SKILL.md:164-167 SKILL.md:167-169 SKILL.md:169-172 SKILL.md:172-174 SKILL.md:174-177 SKILL.md:177-179 SKILL.md:179-182 SKILL.md:182-189 SKILL.md:189-193 SKILL.md:193-196 SKILL.md:196 SKILL.md:199 SKILL.md:202 SKILL.md:205 SKILL.md:208

Detected Patterns

Screen capture upload
Audited by: claude View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/enactprotocol-enact-firecrawl/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/enactprotocol-enact-firecrawl/security.svg)](https://skillstore.io/skills/enactprotocol-enact-firecrawl?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/enactprotocol-enact-firecrawl?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/enactprotocol-enact-firecrawl/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/enactprotocol-enact-firecrawl.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

EnactProtocol. (2026). enact-firecrawl security audit report (audit version 5) [Author version 1.2.1]. Skillstore. https://skillstore.io/skills/enactprotocol-enact-firecrawl/audits/5

BibTeX citation

@techreport{enactprotocol-enactprotocol-enact-firecrawl-2026, author = {EnactProtocol}, title = {enact-firecrawl security audit report (audit version 5)}, institution = {Skillstore}, year = {2026}, number = {5}, url = {https://skillstore.io/skills/enactprotocol-enact-firecrawl/audits/5}, note = {Author version 1.2.1} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "enact-firecrawl security audit report (audit version 5)" version: "1.2.1" type: report authors: - name: "EnactProtocol" date-released: "2026-07-09" url: "https://skillstore.io/skills/enactprotocol-enact-firecrawl/audits/5" identifiers: - type: other value: "skillstore:enactprotocol-enact-firecrawl:audit:5" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
55
Architecture
100
Maintainability
87
Content
69
Community
91
Spec Compliance

What You Can Build

Collect documentation for AI analysis

Crawl a documentation site and convert selected pages into markdown for review or summarization.

Monitor public web information

Search the web or scrape target pages to gather clean content for research notes.

Extract structured page data

Use a natural language prompt and optional schema to pull pricing, headlines, links, or metadata from pages.

Try These Prompts

Scrape one page 
Use Firecrawl to scrape this public URL as markdown: [URL]. Return the main content and page metadata.
Crawl a small documentation site 
Use Firecrawl to crawl [DOCUMENTATION_URL] with a limit of 10 pages. Summarize the key topics found.
Find relevant pages before scraping 
Use Firecrawl map on [SITE_URL] and filter for pages related to [TOPIC]. List the most relevant URLs.
Extract schema-based information 
Use Firecrawl extract on [URL]. Extract [FIELDS] using a JSON schema, then explain any missing values.

Best Practices

  • Use the smallest crawl limit that can answer the task.
  • Scrape only public pages that you are authorized to process.
  • Store FIRECRAWL_API_KEY as a secret and rotate it if exposed.

Avoid

  • Do not scrape private, sensitive, or access-controlled content without authorization.
  • Do not request screenshots unless visual page content is required.
  • Do not send secrets, credentials, or private data inside extraction prompts or schemas.

Frequently Asked Questions

What does this skill need to run?
It needs a Firecrawl API key stored as the FIRECRAWL_API_KEY secret.
Does this skill access the network?
Yes. It sends requests to the Firecrawl API and Firecrawl processes the target URLs or search queries.
Can it crawl an entire website?
It can crawl reachable pages up to the limit you set. Large crawls may time out or require higher Firecrawl limits.
Can it return screenshots?
The Firecrawl service supports screenshot output when requested in formats. Use this only when visual content is needed.
Can it extract structured data?
Yes. The extract action accepts a natural language prompt and can also use a JSON schema string.
Is this safe for private content?
Use caution. URLs, prompts, schemas, and returned content are processed by Firecrawl, so avoid private or sensitive data.

Developer Details

License

MIT

Author version

v1.2.1

Skillstore revision

r1

Repository

https://github.com/EnactProtocol/enact/tree/main/examples/tools/firecrawl

Ref

1ffa7643651792ccb4bd3b15d924d2c97edff755

Maintenance freshness

7/18/2026

Usage

7 downloads · 138 views

File structure

📄 firecrawl.py

📄 SKILL.md