cli

What the source does

• FilesystemDeclared1 observation
• NetworkDeclared9 observations
• ShellDeclared3 observations
• DependenciesNot pinnedSome versions float
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass, no license.

exec(`git clone --depth 1 https://github.com/${repo}.git "${tmpDir}"`, {

exec(

exec(command, (error: Error | null) => {

.prettierrc.json

...(await exec(process.execPath, ['dist/index.js', ...args], {

: exec(command, options)

const hash = crypto.createHash('sha1');

return createHash('sha1')

import packageJson from '../../package.json';

} from '../../commands/batch-scrape';

import { getClient } from '../../utils/client';

import { initializeConfig } from '../../utils/config';

vi.mock('../../utils/client', async () => {

baseUrl = `http://127.0.0.1:${(server.address() as { port: number }).port}`;

url = `http://127.0.0.1:${address.port}`;

FIRECRAWL_API_URL: `http://127.0.0.1:${address.port}`,

apiUrl = `http://127.0.0.1:${(server.address() as AddressInfo).port}`;

@inquirer/prompts, commander, jsonc-parser, smol-toml, yaml, @types/node, husky, lint-staged

curl -fsSL https://firecrawl.dev/install.sh | bash -s -- --agent openclaw

Audit 0.4.1 · source sha 26630e12ae63 · 24 Oct 2026Report an issue or request a re-scan

• Publisherfirecrawl GitHub organizationOwner of the repository this skill is read from
• Source folderfirecrawl/cliThe exact folder we audited
• LicenceNot declaredAs the repository states it
• Commit pinned for this verdict26630e12ae63A new audit runs when the source changes
• Repository statusNot archivedPushed today
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Autonomously navigate websites and extract structured data across pages. Use when the task requires navigation or no suitable ready-made workflow or data provider covers it.

---
name: firecrawl-agent
description: Autonomously navigate websites and extract structured data across pages. Use when the task requires navigation or no suitable ready-made workflow or data provider covers it.
allowed-tools:
  - Bash(firecrawl *)
  - Bash(npx firecrawl-cli *)
---

# firecrawl agent

AI-powered autonomous extraction. The agent navigates sites and extracts structured data (takes 2-5 minutes).

Before starting autonomous extraction for structured records or listings, check `firecrawl search alexandria '<data you need>'` for a ready-made workflow or data provider. Inspect a matching contract with `firecrawl list <provider> <capability> --pretty` and execute with `firecrawl scrape --alexandria <provider>/<capability> --options '<input JSON>'` if it covers the task. Use the exact provider, capability, and input fields from that contract. Continue with Agent when no suitable tool exists or the task requires autonomous navigation.

## Quick start

```bash
# Extract structured data
firecrawl agent "extract all pricing tiers" --wait --json -o .firecrawl/pricing.json

# With a JSON schema for structured output
firecrawl agent "extract products" --schema '{"type":"object","properties":{"name":{"type":"string"},"price":{"type":"number"}}}' --wait --json -o .firecrawl/products.json

# Focus on specific pages
firecrawl agent "get feature list" --urls "<url>" --wait --json -o .firecrawl/features.json
```

Run `firecrawl agent --help` for the full option list.

**Done when:** the output file contains valid JSON answering the request — or a job ID was intentionally returned for later polling.

## Alexandria providers

A run uses connected Alexandria data providers only when it starts with an Alexandria flag: `--alexandria`, `--toolkits <slugs>` (up to 5), `--max-calls <n>`, `--require-approval`, or `--on-terms-required skip|ask`. Follow-ups on its thread keep those settings.

```bash
firecrawl agent "find the head of sales at <company>" --toolkits apollo,crunchbase --wait --json -o .firecrawl/contacts.json
```

With `--require-approval` (needs `--mode chat`), a run can end on a `pendingApproval` instead of making a paid call. Ask the user, then answer it on the same thread with `firecrawl agent "<follow-up prompt>" --thread <threadId> --mode chat --approve <approvalId>` (or `--decline <approvalId>`). A `terms` approval only continues once an organization admin accepts the provider's terms in the Firecrawl dashboard; give the user https://www.firecrawl.dev/app/settings?tab=data-sources, and use `firecrawl alexandria terms show <provider>` if they want to review the terms first. Approving does not accept them.

## Job IDs

Omitting `--wait` returns a job ID. A UUID positional argument is auto-detected as a status check:

```bash
# Check once (equivalent to adding --status)
firecrawl agent "<job-id>"

# Wait on an existing job, polling every 10 seconds for up to 5 minutes
firecrawl agent "<job-id>" --wait --poll-interval 10 --timeout 300

# Cancel an active job
firecrawl agent "<job-id>" --cancel
```

## Tips

- Use `--wait` for inline results; omit it only when you want a job ID to poll later (see [Job IDs](#job-ids)).
- Use `--schema` for predictable, structured output — otherwise the agent returns freeform data.
- Agent runs consume more credits than simple scrapes. Use `--max-credits` to cap spending.
- For simple single-page extraction, prefer `scrape` — it's faster and cheaper.

## See also

- [firecrawl-scrape](../firecrawl-scrape/SKILL.md) — simpler single-page extraction
- [firecrawl-interact](../firecrawl-interact/SKILL.md) — scrape + interact for manual page interaction (more control)
- [firecrawl-crawl](../firecrawl-crawl/SKILL.md) — bulk extraction without AI
- [firecrawl-build-scrape](https://github.com/firecrawl/skills/tree/main/skills/build/firecrawl-build-scrape) — building structured extraction into an app instead of running it here

## Alexandria session feedback

To report an Alexandria session outcome or a provider/capability gap, use `firecrawl alexandria feedback --rating good|partial|bad --url <website> --requested-functionality '<what was needed>' --objective '<the underlying goal of the task>' --rationale '<what happened>' --json`. Use observed results in the rationale. No job ID is needed; send it within 20 minutes of your last Alexandria search, discovery, or execution, or it is rejected. Each submission refunds 1 credit, up to 10 per website and 100 per team each UTC day. Optional `--provider-feedback` and `--capability-feedback` JSON arrays describe specific gaps; inspect `firecrawl alexandria feedback --help` for their fields. Use the capability issue `missing_capability` when a provider exists but lacks the needed capability, and `new_capability_request` (with `requestedFunctionality`) to ask for one.

Excerpt, first 4,821 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

1. 2026-10-24
   ✕BLOCK D 60 / 100

   first audit · source 26630e12ae63

Questions about cli

• github.com/firecrawl/cli — the audited source at commit 26630e12ae63 and every finding aboveObserved · 24 Oct 2026

Spotted something wrong? Report a correction · Methodology