firecrawl-upgrade-migration
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEDYNAMIC_CONTEXT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_CONTEXT_INJECTION]: The skill utilizes the dynamic context injection syntax (
!command) to executenpm listwhen the skill is loaded. This is used solely to identify the current installation status of the Firecrawl SDK in the local environment and presents no security risk. - [COMMAND_EXECUTION]: The skill provides standard shell commands for git operations, package management, and running tests. These commands are transparent, use standard developer tools, and are consistent with the skill's stated purpose of migrating code.
- [EXTERNAL_DOWNLOADS]: The skill references and installs the
@mendable/firecrawl-jspackage. This is the official SDK for Firecrawl, a well-known service, and the installation targets the standard NPM registry. - [DATA_EXPOSURE]: The skill includes a code snippet that uses
process.env.FIRECRAWL_API_KEY. This is a standard and safe practice for providing credentials to an SDK during local testing and does not involve exfiltration to untrusted destinations.
Audit Metadata