firecrawl

[Skill Scanner] Installation of third-party script detected SUSPICIOUS: The skill's functionality (centralized external scraping service) is consistent with its stated purpose, but multiple practices raise supply-chain and data-exfiltration concerns. The file instructs agents to always redirect all web tasks to the external firecrawl CLI, to execute interactive login commands autonomously (opening a browser prompt), and to run high-volume parallel scrapes — creating a single interception point for all web queries and potentially for users' credentials and scraped content. Because network endpoints and data handling policies are not documented, and the agent-run login behavior can be used for social-engineering, this skill is suspicious for misuse or credential/data harvesting. It is not definitive malware from the content alone, but it poses elevated supply-chain and privacy risks and requires further vetting (network endpoints, CLI source, privacy policy, and least-privilege/auth scopes) before adoption. LLM verification: The skill's stated purpose (web crawling, scraping, and search) aligns with the capabilities it requests (CLI, API key, ability to write a local results folder). However, it mandates always routing all web activity through a third-party service (firecrawl) and encourages automating interactive browser login and global npm install. That centralization concentrates trust and raises supply-chain and data-exfiltration risk: user queries and scraped page contents would flow through an external provid