·
Last changedVersion:
This version passed the hardening gate. Hardening applied 28 targeted changes, normalized allowed-tools to the canonical single-string form, and preserved all other text. Classified findings before hardening: 10. Classified findings closed: 6. Classified findings remaining: 4. Unclassified scanner findings remaining: 0. Review findings closed: 13. Review findings remaining: 10.
3
7
4
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
SKILL.md | Sensitive Data & Secret Exposure | Hardcoded secret | Medium | Closed | |
rules/install.md | Supply Chain & Install-Time Trust | — | Medium | Closed | |
SKILL.md | Supply Chain & Install-Time Trust | — | Medium | Closed | |
rules/install.md | Supply Chain & Install-Time Trust | Dependency or plugin compromise | Low | Closed | |
rules/install.md | Supply Chain & Install-Time Trust | Install-time download and execute | Low | Open | |
SKILL.md | Tool & MCP Manipulation | MCP configuration abuse | Low | Open | |
SKILL.md | Prompt Injection | Third-party content as instructions | Low | Open | |
rules/security.md | Malicious Code & Command Execution | — | Low | Closed |
10 findings
Search, scrape, and interact with the web. Returns clean markdown optimized for LLM context windows.
Run firecrawl --help or firecrawl <command> --help for full option details.
If the task is to integrate Firecrawl into an application, add FIRECRAWL_API_KEY to a project, or choose endpoint usage in product code, use the firecrawl-build skills. If the task is an outcome workflow such as deep research, SEO audit, QA, lead generation, knowledge-base creation, dashboard reporting, shopping research, or website design-system extraction, use the firecrawl-workflows skills.
Must be installed. Check with firecrawl --status.
Authenticating gives the best results. Prefer a free account via firecrawl init --browser (browser login) or a FIRECRAWL_API_KEY whenever the human can sign up.
If not ready, see rules/install.md. For output handling guidelines, see rules/security.md.
Before doing real work, verify the setup with one small request:
Follow this escalation pattern:
map --search to find the right URL, then scrape it.| Need | Command | When |
|---|---|---|
Find pages on a topic |
| No specific URL yet |
Find research papers |
| Biomedical/clinical/scientific literature — never scrape PubMed by hand |
Get a page's content |
| Have a URL, page is static or JS-rendered |
Find URLs within a site |
| Need to locate a specific subpage |
Bulk extract a site section |
| Need many pages (e.g., all /docs/) |
AI-powered data extraction |
| Need structured data from complex sites |
Interact with a page |
| Content requires clicks, form fills, pagination |
Download a site to files |
| Save an entire site as local files |
Parse a local file |
| File on disk (PDF, DOCX, XLSX, etc.) — not a URL |
Watch pages for changes |
| Schedule recurring scrapes/crawls, diff against snapshots |
For detailed command reference, run firecrawl <command> --help.
Scrape vs interact:
scrape first. It handles static pages and JS-rendered SPAs.scrape + interact when you need to interact with a page, such as clicking buttons, filling out forms, navigating through a complex site, infinite scroll, or when scrape fails to grab all the content you need.search instead.Monitor: Schedule recurring scrapes or crawls and diff each result against the last retained snapshot. Use for product pages, docs, blogs, changelogs, competitor sites — any page where changes matter. Each monitor should include a short goal describing what changes matter, and each check labels pages as same, new, changed, removed, or error.
When writing --goal, convert the user's monitoring intent into a concise 2-3 sentence monitor goal, similar to the web app setup flow:
Alert when ... and state what should trigger an alert using the user's stated intent.Ignore ... sentence only for intent-specific exclusions that are obvious from the request, such as points/comments for rankings, unrelated marketing copy for pricing, or general company-page updates for jobs.Good goal examples:
top 10 hackernews stories
Goal: Alert when stories enter, leave, or change rank within the Hacker News top 10. Ignore points, comments, and timestamps. Do not alert on changes outside the top 10.pricing changes
Goal: Alert when pricing information changes, including prices, plan names, billing periods, tiers, limits, or included features. Ignore unrelated marketing copy, testimonials, and regional currency display changes unless the underlying offer changes.new engineering roles
Goal: Alert when a new engineering role is posted. Ignore general company-page updates unless they add, remove, or change an engineering role.track this page
Goal: Alert when substantive visible content on this page changes.any change
Goal: Alert when any visible page content changes, including copy, numbers, timestamps, counters, links, and layout text.Subcommands: create | list | get | update | delete | run | checks | check.
Schedules accept cron (--cron "*/5 * * * *") or natural language (--schedule "every 5 minutes"). Minimum interval is 5 minutes. Targets are --page <url> for one page, --scrape-urls a,b,c for multiple scrape URLs, or --crawl-url <url> for a whole-site crawl each check. Use --goal for flag-based monitor creation, or include "goal": "..." in JSON payloads. Note: --state (not --status) sets active/paused; --page-status (not --status) filters page results on check — avoids collision with the global --status flag. Monitoring is not available for zero-data-retention teams.
JSON-mode change tracking: By default monitors diff each page's markdown and you get a unified text diff back. When you care about specific structured fields (price, headline, in-stock flag, items in a list) instead of the whole page, add a changeTracking format with modes: ["json"] and a JSON schema to the target's scrapeOptions.formats. The flag-based form doesn't cover this — pass a JSON body via file or stdin:
The check response then carries a per-field diff (paths like plans[0].price) and the full extraction at this run, instead of (or in addition to) a markdown diff. Each changed page in pages[] looks like:
Use modes: ["json", "git-diff"] for mixed mode: you get both diff.json (per-field) and diff.text (markdown sidecar), and the page is marked changed whenever either surface changed. For markdown-only monitors, diff.text holds the unified diff and diff.json is a parse-diff AST ({ files: [...] }); there is no snapshot.
Avoid redundant fetches:
search --scrape already fetches full page content. Don't re-scrape those URLs..firecrawl/ for existing data before fetching again.firecrawl research search-papers, documented in firecrawl-search. Do not scrape PubMed or Google Scholar by hand, and do not reach for search --categories research — that is a website filter, not the paper index.firecrawl-build skillsfirecrawl-workflows skills. These skills infer from context first and ask only short blocking questions when needed.Unless the user specifies to return in context, write results to .firecrawl/ with -o. Add .firecrawl/ to .gitignore. Always quote URLs - shell interprets ? and & as special characters.
Naming conventions:
Never read entire output files at once. Use grep, head, or incremental reads:
Single format outputs raw content. Multiple formats (e.g., --format markdown,links) output JSON.
These patterns are useful when working with file-based output (-o flag) for complex tasks:
Search costs 2 credits per call. After you finish using a search result, send structured feedback. The first feedback per search id refunds 1 credit and feeds search-quality improvements.
The most useful field is --missing-content: an array of specific pieces of content you expected to find but didn't. Use one entry per missing topic. Bad/partial feedback with detailed --missing-content is just as valuable as good feedback.
Opt out: export FIRECRAWL_NO_SEARCH_FEEDBACK=1 makes the CLI skip every feedback call silently. Respect that flag — do not try to work around it. See firecrawl-search for the full pattern.
For non-search endpoint jobs, use firecrawl feedback <endpoint> <jobId> to send concise job-level feedback through /v2/feedback. Supported endpoints are search, scrape, parse, and map.
Keep generic feedback small: issue codes, tags, short notes, URLs, page numbers, and small metadata objects. Do not send raw scrape/parse outputs or full page contents as feedback.
Opt out: export FIRECRAWL_NO_ENDPOINT_FEEDBACK=1 makes the CLI skip every endpoint feedback call silently. Respect that flag — do not try to work around it.
Run independent operations in parallel. Check firecrawl --status for concurrency limit:
For interact, scrape multiple pages and interact with each independently using their scrape IDs.
Get started with chainctlchainctl skill install public/firecrawl/firecrawl-cli:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/firecrawl/skills/firecrawl-cli:latest
ISC
HARDENING.md
SKILL.md
rules/install.md
rules/security.md