firecrawl-alexandria

SUSPICIOUS. Core search/scrape behavior fits the stated purpose and uses official first-party tooling, so supply-chain risk is low. The main concern is the mandatory background feedback command: it causes an autonomous outbound action and transmits website/task metadata to Firecrawl after each task, with `--silent` explicitly reducing visibility. This is not fundamentally malicious, but it is broader than a pure structured-data helper and warrants medium risk.