The skill allows arbitrary file writes and SSRF
Claims to do
Firecrawl CLI: Web scraping, search, and page interaction CLI. Returns clean markdown optimized for LLM context windows.
Actually does
This skill executes the `firecrawl` CLI tool (or `npx firecrawl`) via Bash to perform web scraping, searching, crawling, and page interaction. It contacts external URLs and the Firecrawl API, reading and writing various files (markdown, JSON) to a `.firecrawl/` directory for output and organization.
The skill allows the `firecrawl` command with arbitrary arguments, including the `-o` flag for output. This enables writing scraped content to any file path on the system, potentially overwriting sensitive files or injecting malicious content into configuration files.
firecrawl scrape "https://firecrawl.dev" -o .firecrawl/install-check.md
The `allowed-tools` entry `Bash(firecrawl *)` grants the agent permission to execute the `firecrawl` command with any arguments. This broad permission could be exploited for command injection if `firecrawl` arguments are not properly sanitized, or for resource exhaustion.
allowed-tools: - Bash(firecrawl *)
As a web scraping tool, `firecrawl` can be directed to arbitrary URLs. If the agent's execution environment has access to internal networks, this could be leveraged for SSRF attacks or internal network reconnaissance by targeting internal IP addresses or hostnames.
firecrawl scrape "<url>"
The `firecrawl crawl` and `firecrawl download` commands can be used to fetch large amounts of data. This could lead to excessive network traffic, storage consumption, or exhaustion of API credits, impacting system availability or incurring costs.
Workflow: 4. Crawl - Need bulk content from an entire site section; 'Download a site to files | `download`'
The skill description explicitly forbids 'local file operations,' but the `firecrawl` tool, as configured, can perform local file writes via its `-o` flag. A malicious prompt could exploit this discrepancy, instructing the agent to perform a forbidden action that the underlying tool technically allows.
Description: 'Do NOT trigger for local file operations...'; Capability: `firecrawl scrape "..." -o .firecrawl/install-check.md`
The `allowed-tools` explicitly permit only `firecrawl` and `npx firecrawl` commands. However, the workflow examples demonstrate the use of other shell utilities like `jq`, `wc`, `head`, and `grep` for processing output, which are not explicitly allowed by the skill's `allowed-tools` definition. This could lead to agent confusion or attempts to execute unauthorized commands.
allowed-tools: - Bash(firecrawl *); Example: `jq -r '.data.web[].url' .firecrawl/search.json`
[](https://mondoo.com/ai-agent-security/skills/github/firecrawl/cli/firecrawl-cli)<a href="https://mondoo.com/ai-agent-security/skills/github/firecrawl/cli/firecrawl-cli"><img src="https://mondoo.com/ai-agent-security/api/badge/github/firecrawl/cli/firecrawl-cli.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/github/firecrawl/cli/firecrawl-cli.svgSkills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.