Web search and scraping via Firecrawl API. Use when you need to search the web, scrape websites (including JS-heavy pages), crawl entire sites, or extract structured data from web pages. Requires FIRECRAWL_API_KEY environment variable.
Security Analysis
medium confidenceThe skill's code and docs implement Firecrawl search/scrape/crawl and only need an API key, but the package metadata omits that required credential and the SKILL.md references CLI commands that aren't provided — this mismatch suggests sloppy packaging and you should verify the origin and the API key usage before installing.
The name/description, SKILL.md, references/api.md, and the three Python scripts all consistently implement web search, scraping, and crawling via api.firecrawl.dev. That functionality matches the stated purpose. However, the registry metadata claims no required environment variables or primary credential while both the SKILL.md and all scripts explicitly require FIRECRAWL_API_KEY; additionally SKILL.md example CLI commands (firecrawl_search, firecrawl_scrape, firecrawl_crawl_status) do not correspond exactly to the provided script filenames (search.py, scrape.py, crawl.py). These inconsistencies are disproportionate to the task and indicate packaging sloppiness.
Runtime instructions and scripts only perform POST/GET calls to https://api.firecrawl.dev endpoints and require the FIRECRAWL_API_KEY. They do not read unrelated local files, other environment variables, or system config paths, nor do they send data to unexpected third-party domains. The scope of actions described in SKILL.md is limited to web search/scrape/crawl.
There is no install spec (instruction-only), which minimizes installation risk. The bundle does include three executable Python scripts (no external downloads or installers). Because there is no packaging/installation step described, the SKILL.md's suggested CLI command names may be misleading unless the system supplies wrappers; this is a minor risk for usability/confusion but not an immediate code-execution red flag.
All scripts and the SKILL.md require FIRECRAWL_API_KEY, which is appropriate for a service-backed scraping/search skill. However, the registry metadata incorrectly lists no required env vars or primary credential. That mismatch is concerning because it may mislead users about what secrets are needed and how they are used. Also, the skill will send whatever URLs/queries you provide to api.firecrawl.dev — ensure you trust that service before sending sensitive targets or data.
The skill does not request persistent presence (always is false), does not modify other skills or system-wide settings, and does not request elevated privileges. Autonomous invocation is allowed (platform default) but not combined with other high-risk factors here.
Guidance
This package mostly does what it says (calls api.firecrawl.dev to search, scrape, and crawl) but the registry metadata is inconsistent with the code/docs. Before installing: (1) Verify the skill's origin and owner — there is no homepage and the source is 'unknown'. (2) Confirm FIRECRAWL_API_KEY is required and that you are comfortable giving that key to this skill; prefer a scoped or test key, not a production key. (3) Check that api.firecrawl.dev is the legitimate Firecrawl endpoint and review its privacy/pricing. (4) Note SKILL.md CLI names don't match included script filenames — expect to run the Python scripts directly or ask the publisher for proper wrappers. (5) Run initial tests in a sandboxed environment and monitor outbound network requests. If the publisher cannot explain the metadata mismatch or provide a trustworthy homepage/source, treat the package with caution.
Latest Release
v1.0.0
Web search and scraping via Firecrawl API
Popular Skills
Published by @ashwingupy on ClawHub
