📦
firecrawl-build-scrape
82Build Firecrawl Single-Page Scraping
Apps often need clean content from one known URL. This skill guides a focused Firecrawl /scrape integration for page extraction.
Coding & Development View
Skills firecrawl-build-onboarding
📦
firecrawl-build-onboarding
v0.1.0 Content revision r1 High Risk ⚙️ External commands🌐 Network access🔑 Env variables📁 Filesystem access
Set Up Firecrawl App Access
Teams need a clear path from Firecrawl signup to a working application integration. This skill guides credential setup, SDK choice, and smoke testing for Claude, Codex, and Claude Code workflows.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "firecrawl-build-onboarding" from https://skillstore.io/skills/firecrawl-firecrawl-build-onboarding.md and its manifest at https://skillstore.io/api/skills/firecrawl-firecrawl-build-onboarding/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "firecrawl-build-onboarding". Set up Firecrawl for a new TypeScript service.
Expected outcome:
- Identifies that browser authorization is needed before code changes.
- Selects the Node or TypeScript SDK path from the documentation.
- Plans an environment variable update and one smoke test request.
Using "firecrawl-build-onboarding". Configure self-hosted Firecrawl in an existing app.
Expected outcome:
- Finds the project secret configuration pattern.
- Adds guidance for both the API key and custom API URL.
- Recommends mirroring the setup across deployment environments.
Using "firecrawl-build-onboarding". Choose how to proceed after credentials are available.
Expected outcome:
The skill directs the agent to pick the narrowest Firecrawl endpoint, read the language-specific source page, and run a real smoke test.
Security Audit
High Riskv4 • 7/5/2026 Open versioned report
Most static findings are Markdown formatting, documentation links, placeholders, or expected Firecrawl onboarding references. Confirmed risks remain around credential handling, direct `.env` updates, and an unpinned `npx @latest` installer command that executes remote package code.
4
Files scanned
182
Lines analyzed
11
Review items
0
False positives ignored
Confirmed security concerns (8)
High
Environment file access
echo "FIRECRAWL_API_KEY=fc-..." >> .env
The instruction writes directly to `.env`, a sensitive project configuration file. This requires explicit user consent and protections against accidental source control exposure.
High
Environment file access
For hosted Firecrawl, add this to `.env`:
The guidance explicitly instructs adding hosted Firecrawl credentials to `.env`. This is legitimate but sensitive because `.env` files often contain secrets.
High
Environment file access
description: Get Firecrawl credentials and SDK setup into a project. Use when an application needs `
The description tells agents to add Firecrawl credentials to `.env`. This is legitimate onboarding but creates risk if done without confirmation or file protections.
High
Environment file access
- the user wants Firecrawl wired into `.env`
The skill explicitly applies when Firecrawl is wired into `.env`. Environment-file updates can expose secrets if the file is tracked or mishandled.
High
Environment file access
If the user already has an API key, place it in `.env`:
The quick start instructs placing an API key in `.env`. This is common practice, but it is sensitive file modification.
High
Environment file access
| **Put credentials into `.env` or project config** | [references/project-setup.md](references/proje
The reference table points to putting credentials into `.env` or project config. That is intentional but remains sensitive credential persistence.
High
Agent-Mediated API Key Persistence
The auth flow documents receiving an `apiKey` from the polling endpoint and then appending a Firecrawl API key to `.env`, placing the agent in the path of a secret.
The endpoint response example includes `apiKey`, and the final step writes a key into `.env`. This is intended onboarding, but it is clear credential handling.
Medium
Unpinned Remote Package Execution
The install instructions run `npx -y firecrawl-cli@latest init --all --browser`, which executes the latest published package without pinning a reviewed version.
The command is directly present in the install section and uses both `@latest` and `-y`. The purpose is legitimate, but the supply-chain exposure is real.
Capability review items (11)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Generic API/secret keys
echo "FIRECRAWL_API_KEY=fc-..." >> .env
The auth flow ends by appending a Firecrawl API key value to `.env`. This is intended behavior, but it handles secret material and can expose credentials if the file is committed or logged.
High
Generic API/secret keys
FIRECRAWL_API_KEY=fc-...
The example documents storing `FIRECRAWL_API_KEY` in environment configuration. It is expected setup guidance, but it is still credential handling that can leak if copied into tracked files.
High
Generic API/secret keys
FIRECRAWL_API_KEY=fc-...
The self-hosted example includes `FIRECRAWL_API_KEY` in environment configuration. The value is a placeholder, but the operational flow handles real secrets.
High
Generic API/secret keys
Install the SDK that matches the project stack after `FIRECRAWL_API_KEY` is available.
The line gates SDK installation on `FIRECRAWL_API_KEY` being available, so the skill workflow depends on secret material. The line does not reveal a key, but it confirms credential handling.
High
Generic API/secret keys
description: Get Firecrawl credentials and SDK setup into a project. Use when an application needs `
The skill description says agents should add `FIRECRAWL_API_KEY` to project configuration. This is expected, but it means the skill handles credentials.
High
Generic API/secret keys
- name: FIRECRAWL_API_KEY
The declared input is `FIRECRAWL_API_KEY`, which is a secret credential. It is a legitimate input, but it should be treated as sensitive data.
High
Generic API/secret keys
- a project needs `FIRECRAWL_API_KEY`
The usage condition explicitly targets projects needing `FIRECRAWL_API_KEY`. This is credential setup, so secret-handling safeguards are required.
High
Generic API/secret keys
FIRECRAWL_API_KEY=fc-...
The quick start shows the API key variable inside a dotenv block. The value is a placeholder, but users will replace it with a real secret.
High
Generic API/secret keys
| **Run the browser auth flow and save `FIRECRAWL_API_KEY`** | [references/auth-flow.md](references/
The task table directs agents to run auth and save `FIRECRAWL_API_KEY`. This is intended, but it involves handling and persisting a credential.
Medium
Ruby/shell backtick execution
```bash
The code block contains an `npx -y firecrawl-cli@latest init --all --browser` install command, which executes a remotely fetched latest package. This is legitimate onboarding, but it carries supply-chain and implicit-consent risk.
Medium
Ruby/shell backtick execution
```
This finding range is part of the install command block that runs `npx -y firecrawl-cli@latest`. The risk is remote package execution during setup, not Ruby backtick execution.
Risk Factors
⚙️ External commands (16)
🌐 Network access (13)
🔑 Env variables (13)
📁 Filesystem access (3)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/firecrawl-firecrawl-build-onboarding/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/firecrawl-firecrawl-build-onboarding?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/firecrawl-firecrawl-build-onboarding?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/firecrawl-firecrawl-build-onboarding/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/firecrawl-firecrawl-build-onboarding.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
firecrawl. (2026). firecrawl-build-onboarding security audit report (audit version 4) [Author version 0.1.0]. Skillstore. https://skillstore.io/skills/firecrawl-firecrawl-build-onboarding/audits/4BibTeX citation
@techreport{firecrawl-firecrawl-firecrawl-build-onboarding-2026,
author = {firecrawl},
title = {firecrawl-build-onboarding security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/firecrawl-firecrawl-build-onboarding/audits/4},
note = {Author version 0.1.0}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "firecrawl-build-onboarding security audit report (audit version 4)"
version: "0.1.0"
type: report
authors:
- name: "firecrawl"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/firecrawl-firecrawl-build-onboarding/audits/4"
identifiers:
- type: other
value: "skillstore:firecrawl-firecrawl-build-onboarding:audit:4"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: High 45
Architecture
100
Maintainability
87
Content
68
Community
91
Spec Compliance
What You Can Build
Add Firecrawl to a New App
A developer can create credentials, install the right SDK, and add a first verified Firecrawl request.
Standardize Team Setup
A technical lead can give agents a repeatable process for local, preview, and production credential setup.
Prepare Self-Hosted Configuration
A platform engineer can add both the API key and custom Firecrawl API URL for internal deployments.
Try These Prompts
Start Firecrawl Setup
Use this skill to set up Firecrawl for this project. Ask me before changing environment files.
Use Existing Key
I already have a Firecrawl API key. Add the correct environment variable guidance and choose the SDK for this stack.
Integrate Into Existing Codebase
Inspect the repository configuration patterns, then plan the safest Firecrawl SDK integration and smoke test.
Plan Production Rollout
Design a Firecrawl onboarding plan for development, preview, and production using secret managers where possible.
Best Practices
- Ask for user confirmation before creating or modifying environment files.
- Use a platform secret manager for shared, preview, or production credentials.
- Run one smoke test after SDK installation to prove the key and endpoint work.
Avoid
- Do not commit `.env` files or Firecrawl API keys to source control.
- Do not run unpinned installer commands in regulated environments without review.
- Do not choose a broad Firecrawl endpoint before defining the product behavior.
Frequently Asked Questions
Does this skill create a Firecrawl account?
No. It guides the browser authorization flow so the user can sign in or create an account.
Can it work with an existing API key?
Yes. It can guide placement of an existing key in environment configuration or a secret manager.
Which programming languages are covered?
It links to Firecrawl source pages for Node, Python, Rust, Java, Elixir, and REST usage.
Does it write application scraping logic?
No. It prepares credentials and SDK setup, then points to endpoint-specific implementation guidance.
Is a self-hosted Firecrawl deployment supported?
Yes. It includes setup guidance for a custom Firecrawl API URL with the API key.
What security care is needed?
Protect API keys, avoid committing environment files, and confirm any installer or credential file changes.
Developer Details
Author
firecrawlLicense
ISC
Author version
v0.1.0
Skillstore revision
r1
Ref
30c73eac2afe762f6aa9c4553158769369d47351
Maintenance freshness
7/18/2026
Usage
2 downloads · 57 views
File structure
More from firecrawl
View all📦
firecrawl-build-interact
82Build Firecrawl Browser Interactions
Dynamic pages often hide data behind clicks, forms, and login flows. This skill helps teams choose and scope Firecrawl /interact integrations.
Coding & Development View
📦
firecrawl-build-search
81Build Firecrawl Search Workflows
Teams need reliable source discovery before scraping or answering questions. This skill guides Firecrawl search integration, result selection, and follow-up extraction decisions.
Coding & Development View
📦
firecrawl-search
78Search the Web with Firecrawl
Current web research often needs more than short search snippets. This skill runs Firecrawl searches, saves structured results, and can extract full page content for review.
Research & Learning View
📦
firecrawl-crawl
78Crawl Websites with Firecrawl
Teams need reliable content from many pages without manual copying. This skill guides Firecrawl crawls with scoped paths, limits, progress, and saved results.
Data & Analytics View
📦
firecrawl-scrape
77Scrape Web Pages Into Clean Markdown
Web pages can be hard to extract cleanly when scripts render important content. This skill uses Firecrawl to scrape URLs into LLM-ready markdown and optional formats.
Research & Learning View
Related Skills
View all📦
vercel-deployment
78Deploy Next.js Apps to Vercel
by sickn33
Vercel deployments can fail because environment settings, runtimes, and build behavior differ across stages. This skill guides Claude, Codex, and Claude Code through practical Next.js deployment decisions.
DevOps & Infrastructure View
📦
vercel-automation
50Automate Vercel Operations
by sickn33
Vercel administration often requires switching between dashboards, logs, and API details. This skill guides Claude, Codex, and Claude Code through Rube MCP workflows.
DevOps & Infrastructure View
📦
vercel-cli-with-tokens
38Deploy Vercel Projects with Tokens
by vercel-labs
Interactive Vercel login can block AI-assisted deployment workflows. This skill guides token-based CLI setup, preview deployments, project linking, and environment management.
DevOps & Infrastructure View
📦
env-config
38Secure Python Environment Configuration
by AutumnsGrove
Python teams can leak credentials or mix settings across environments. This skill provides local tools and guidance for structured configuration and secrets handling.
DevOps & Infrastructure View
📦
vercel-deploy
38Deploy Next.js Apps on Vercel
by Awais68
Vercel deployments fail when build settings, domains, and environment variables drift. This skill guides configuration, deployment, and troubleshooting for Next.js apps.
DevOps & Infrastructure View
📦
environment-setup
38Configure Environment Variables Safely
by supercent-io
Environment setup can fail when variables, secrets, and deployment settings are inconsistent. This skill creates structured templates, validation guidance, and environment separation plans.
DevOps & Infrastructure View