firecrawl-cli

The documentation outlines standard CLI authentication flows (browser-based and API-key). It is not inherently malicious. However, it introduces security concerns around persisting API keys in plaintext via environment variables and shell initialization files, which can risk leakage in shared or compromised environments. Recommended mitigations include avoiding persistent plaintext keys, using secure secret storage (OS keychain or secret managers), scoped tokens with short lifetimes, and avoiding echoing credentials to logs or terminal history. Consider implementing in-app secure storage and encouraging ephemeral tokens where possible.