pp-firecrawl

SUSPICIOUS. The skill's capabilities broadly match a Firecrawl integration, but it depends on installing and trusting a third-party CLI/MCP from same-publisher sources, including unpinned Go @latest paths and a mutable installer catalog. Data flow to Firecrawl is expected, yet arbitrary webhook delivery can route scraped results elsewhere. No strong signs of malware, credential theft, stealth, or pre-execution abuse were found.