審計紀錄

Static analysis flagged critical combinations of network, filesystem, environment access, and command examples. Review found no confirmed malicious intent or prompt injection, but the skill legitimately sends user-selected URLs to Firecrawl, loads API keys from .env files, and writes files to user-provided paths. Publish only with clear warnings about third-party processing, credential handling, and output path control.

This skill provides legitimate web scraping functionality via Firecrawl API. The 120 static findings are overwhelmingly false positives caused by documentation examples showing bash commands, standard dotenv usage for API key management, and base64 decoding of API responses. Network and filesystem access are core intended features, not security risks.

This skill provides legitimate web scraping functionality via Firecrawl API. The 120 static findings are overwhelmingly false positives caused by documentation examples showing bash commands, standard dotenv usage for API key management, and base64 decoding of API responses. Network and filesystem access are core intended features, not security risks.

This skill provides legitimate web scraping functionality via Firecrawl API. The 120 static findings are overwhelmingly false positives caused by documentation examples showing bash commands, standard dotenv usage for API key management, and base64 decoding of API responses. Network and filesystem access are core intended features, not security risks.

This is a legitimate web scraping skill using the official Firecrawl SDK. The code behavior matches its stated purpose. It accesses filesystem to read user-provided schema files and write outputs, and makes network calls exclusively to the Firecrawl API. No obfuscation, credential theft, or persistence mechanisms detected.

This is a legitimate web scraping skill using the official Firecrawl SDK. The code behavior matches its stated purpose. It accesses filesystem to read user-provided schema files and write outputs, and makes network calls exclusively to the Firecrawl API. No obfuscation, credential theft, or persistence mechanisms detected.

This is a legitimate web scraping skill using the official Firecrawl SDK. The code behavior matches its stated purpose. It accesses filesystem to read user-provided schema files and write outputs, and makes network calls exclusively to the Firecrawl API. No obfuscation, credential theft, or persistence mechanisms detected.