·
Last changedVersion:
This version passed the hardening gate. Hardening applied 3 targeted changes and preserved all other text. Classified findings before hardening: 1. Classified findings closed: 1. Classified findings remaining: 0. Unclassified scanner findings remaining: 0. Review findings closed: 8. Review findings remaining: 11.
1
None
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
SKILL.md | Supply Chain & Install-Time Trust | — | Medium | Closed |
1 finding
AI-powered autonomous extraction. The agent navigates sites and extracts structured data (takes 2-5 minutes).
Before starting autonomous extraction for structured records or listings, check firecrawl search alexandria '<data you need>' for a ready-made workflow or data provider. Inspect a matching contract with firecrawl list <provider> <capability> --pretty and execute with firecrawl scrape --alexandria <provider>/<capability> --options '<input JSON>' if it covers the task. Use the exact provider, capability, and input fields from that contract. Continue with Agent when no suitable tool exists or the task requires autonomous navigation.
Run firecrawl agent --help for the full option list.
Done when: the output file contains valid JSON answering the request — or a job ID was intentionally returned for later polling.
A run uses connected Alexandria data providers only when it starts with an Alexandria flag: --alexandria, --toolkits <slugs> (up to 5), --max-calls <n>, --require-approval, or --on-terms-required skip|ask. Follow-ups on its thread keep those settings.
With --require-approval (needs --mode chat), a run can end on a pendingApproval instead of making a paid call. Ask the user, then answer it on the same thread with firecrawl agent "<follow-up prompt>" --thread <threadId> --mode chat --approve <approvalId> (or --decline <approvalId>). A terms approval only continues once the provider's terms are accepted for the organization, in the dashboard. Approving does not accept them.
Omitting --wait returns a job ID. A UUID positional argument is auto-detected as a status check:
--wait for inline results; omit it only when you want a job ID to poll later (see Job IDs).--schema for predictable, structured output — otherwise the agent returns freeform data.--max-credits to cap spending.scrape — it's faster and cheaper.Get started with chainctlchainctl skill install public/firecrawl/firecrawl-agent:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/firecrawl/skills/firecrawl-agent:latest
ISC
HARDENING.md
SKILL.md