firecrawl-security-basics
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides security-focused guidelines for Firecrawl integration, promoting best practices such as least-privilege access and environment separation.
- [SAFE]: Instructions for API key management correctly recommend using environment variables and
.gitignoreto prevent secret leakage, which is a fundamental security practice. - [SAFE]: The webhook verification code uses
crypto.timingSafeEqualto prevent timing attacks, demonstrating an understanding of secure implementation patterns. - [SAFE]: The skill includes a dedicated section for sanitizing scraped content using regular expressions to remove potentially malicious script tags, data URIs, and JavaScript links, addressing common injection vectors from external web data.
- [SAFE]: Network operations (e.g.,
curltoapi.firecrawl.dev) target the official API for the service documented by the skill and are used for legitimate verification of rotated keys.
Audit Metadata