Most static findings are false positives from Markdown backticks, example.com URLs, and relative documentation links. The remaining risks are contextual: the skill permits unpinned npx execution and encourages skipping confirmation for bulk downloads.
The skill allows Bash(npx firecrawl *), which can resolve and execute an npm package at runtime. This creates supply-chain and version drift risk for a network and filesystem tool.
The allowed-tools entry explicitly permits npx firecrawl commands, and no package version pin is shown. The risk depends on installer behavior, so confidence is high but not absolute.
The skill tells agents to always pass -y and says to use it in automated flows. This removes a confirmation safeguard before bulk downloads and local file writes.
The text directly instructs use of -y to skip confirmation. The skill also downloads many pages to disk, so the operational impact is clear.
Most static findings are false positives from Markdown backticks, example.com URLs, and relative documentation links. The remaining risks are contextual: the skill permits unpinned npx execution and encourages skipping confirmation for bulk downloads.
The skill allows Bash(npx firecrawl *), which can resolve and execute an npm package at runtime. This creates supply-chain and version drift risk for a network and filesystem tool.
The allowed-tools entry explicitly permits npx firecrawl commands, and no package version pin is shown. The risk depends on installer behavior, so confidence is high but not absolute.
The skill tells agents to always pass -y and says to use it in automated flows. This removes a confirmation safeguard before bulk downloads and local file writes.
The text directly instructs use of -y to skip confirmation. The skill also downloads many pages to disk, so the operational impact is clear.
Static analysis found command execution, network URLs, filesystem traversal strings, and weak-crypto patterns. Review confirms the real risks are expected Firecrawl CLI execution, network scraping, and local file creation; the path traversal and weak-crypto findings are false positives from Markdown links and text patterns. No prompt injection, credential exfiltration, obfuscation, or malicious intent was found in SKILL.md.
1
Files scanned
70
Lines analyzed
5
Review items
3
False positives ignored
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The skill grants Bash access to firecrawl and npx firecrawl, then instructs agents to run download commands. This is expected for the skill, but it can execute installed CLI code and should be limited to trusted Firecrawl usage.
The allowed-tools block and command examples directly require external command execution. The commands match the skill purpose, so the concern is operational risk rather than confirmed abuse.
The documented workflow maps and scrapes websites, then saves content under .firecrawl. This can download large or sensitive content if the target URL and include or exclude filters are not reviewed.
The skill explicitly states that it maps sites, scrapes pages, and writes nested directories. This behavior is legitimate for the skill but creates network and filesystem exposure.
Static false positives ignored (3)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Static Path Traversal Findings Are Documentation Links
The ../ strings appear only in Markdown links to neighboring Firecrawl skills. No evidence found that these paths are used for file reads, writes, or command arguments.
The path traversal pattern appears inside Markdown links in a See also section. There is no executable code using these relative paths.
The flagged lines contain skill metadata and an options table, not cryptographic code. No evidence found of MD5, SHA1, encryption, hashing, or signature verification logic.
Manual review of both flagged lines shows prose and table formatting only. The skill contains no cryptographic implementation.
The static network findings point to docs.example.com in command examples. These URLs demonstrate Firecrawl usage and are not hidden endpoints or exfiltration destinations.
The URLs use the example.com reserved domain pattern inside a Quick start section. They are not paired with secrets or unexpected request logic.
Static analysis flagged 34 patterns across external_commands (23), network (6), and filesystem (3) categories. All findings evaluated as FALSE POSITIVES: external_commands are documented CLI usage with allowed-tools declaration, network URLs are documentation examples (docs.example.com), and filesystem references are markdown relative links to other skill files. No malicious intent detected. Minor risk from legitimate Bash command execution and network access for web scraping.
Skill executes firecrawl CLI commands via Bash. Commands are documented examples with user-provided URLs. Risk is mitigated by allowed-tools declaration restricting to firecrawl and npx firecrawl commands only.
Allowed-tools declaration explicitly limits Bash to firecrawl commands - legitimate CLI tooling pattern with bounded execution scope.
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Skill performs network requests to user-specified URLs for web scraping. This is expected behavior for a download tool but requires user trust in target URLs.
Network access is core functionality for web scraping - legitimate use case but requires user awareness of target URL trustworthiness.