firecrawl-mcp
Pass
Audited by Gen Agent Trust Hub on Mar 30, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [SAFE]: The skill's Python scripts are consistent, well-documented wrappers that forward payloads to the OneKey Gateway API. No malicious patterns such as obfuscation, persistence, or unauthorized data exfiltration were detected.
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of
@aiagenta2z/onekey-gateway(NPM) andai-agent-marketplace(PyPI). These are official vendor resources associated with the author 'aiagenta2z' and are necessary for the skill's functionality. - [COMMAND_EXECUTION]: The
firecrawl_browser_executetool provides an interface for running Bash, Python, or Node.js scripts within a remote browser session. This is an intended capability of the integrated Firecrawl service for web automation and does not represent a local vulnerability. - [CREDENTIALS_UNSAFE]: The skill follows best practices by using the
DEEPNLP_ONEKEY_ROUTER_ACCESSenvironment variable for API authentication. A fallback demo keyBETA_TEST_KEY_MARCH_2026is provided for testing, which is standard for development-oriented skills.
Audit Metadata