web-scraping — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited web-scraping (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Extract LLM-ready web content without hacking around: clean markdown, structured JSON, anti-bot and JS-rendering handled. Firecrawl is the reference wrapper; fallback to Playwright or curl + html2text if unavailable.
WebSearch is enoughWebFetch is enough/qa:qa-chrome (the qa-chrome skill is manual-only)export FIRECRAWL_API_KEY="fc-xxx" # https://firecrawl.dev
npm install -g firecrawl-cli # the CLI (`firecrawl`); the SDKs are firecrawl / firecrawl-pyDocker compose available on github.com/mendableai/firecrawl. Useful if data is sensitive or budget is limited.
If Firecrawl is missing, degrade gracefully:
| Need | Fallback | Limitation | |
|---|---|---|---|
| Simple static page | `curl -sL URL \ | pandoc -f html -t markdown` | No JS rendering |
| JS-heavy page | npx playwright + page.content() + markdownify | Heavy, 300MB+ of deps | |
| Whole site | recursive filtered wget | No deduplication, no LLM-ready output |
IMPORTANT: always announce when degrading. The user must know if the content is partial (JS not rendered).
firecrawl-cli v1.25)firecrawl scrape https://example.com/article \
--format markdown,links \
--only-main-contentOutput: clean markdown (navigation / footers stripped), list of links, OG metadata.
firecrawl crawl https://docs.example.com \
--limit 100 \
--include-paths /docs \
--exclude-paths /docs/legacy \
--scrape-options '{"formats":["markdown"]}' \
--wait -o crawl.jsonOutput: one JSON file holding every page (markdown in each entry). Ask for confirmation before crawl > 50 pages (API costs + time).
firecrawl map https://example.com --search "pricing"Output: list of relevant URLs. Useful BEFORE a crawl to target the right sections.
firecrawl agent "Extract the plans with name, price and features" \
--urls https://example.com/pricing \
--schema-file plans.schema.json \
--max-credits 50 --waitOutput: JSON conforming to the schema. Saves hours of fragile CSS selectors. An agent job takes minutes and spends credits: always set --max-credits. (The CLI's former extract command is gone; agent replaced it.)
firecrawl search "best pve proxmox backup strategies" \
--limit 10 \
--scrape --scrape-formats markdownOutput: top N results with extracted content. Replaces WebSearch + N WebFetch.
1. IDENTIFY the need
- 1 page -> scrape
- N known pages -> scrape in a loop with `xargs -P 4`
- Whole site -> map (recon) -> targeted crawl
- Structured data -> agent with a schema
- Search + extract -> search
2. ESTIMATE costs
- Firecrawl cloud: credits per page scraped
- Ask for confirmation if > 50 pages or > 10 MB expected
3. RUN with limits on the first attempt
- --limit 5 to test
- Inspect the output
- Re-run at full volume if OK
4. SAVE the result
- `./scraped/<date>/<domain>.md` by convention
- Commit if data is reusable (mind copyright)
5. CHECK legality / ethics
- Respect robots.txt unless explicitly authorized
- No personal data without consent (GDPR)
- No commercial paywall bypassfirecrawl crawl https://docs.terraform.io/language \
--limit 200 --scrape-options '{"formats":["markdown"]}' \
--wait -o rag-corpus/terraform.jsonfirecrawl agent "Extract the pricing plans of each site" \
--urls url1,url2,url3,url4,url5 \
--schema-file pricing.schema.json \
--max-credits 100 --wait -o pricing-compared.jsonfirecrawl scrape https://example.com/changelog --format markdown -o new-changelog.md
if ! diff -q new-changelog.md last-changelog.md >/dev/null 2>&1; then
diff last-changelog.md new-changelog.md # what changed
mv new-changelog.md last-changelog.md
fi| Signal | Reaction |
|---|---|
Missing FIRECRAWL_API_KEY AND firecrawl self-hosted not detected | Propose explicit fallback, ask the user for their choice |
robots.txt forbids scraping the target path | STOP — ask for explicit authorization before continuing |
| More than 100 pages without confirmation | STOP — announce estimated costs and wait for validation |
| Personal data detected (email, phone, ID) in the output | STOP — do not save without GDPR legal basis |
| Site with login / commercial paywall | STOP — scraping illegal except with explicit contract |
| Repeated 429 rate limit | STOP — exponential backoff, do not hammer |
| Combo | Usage |
|---|---|
web-scraping -> dev:dev-rag | Build a corpus for RAG ingestion |
web-scraping -> biz:biz-competitor | Factual competitive & market analysis on real data |
web-scraping + writing-skills | Import third-party lib docs into a local skill |
qa-chrome instead of web-scraping | Visual tests, DOM interaction, screenshots |
WebSearch for a simple factual question (needlessly expensive)IMPORTANT: Always announce when degrading to a fallback (Playwright / curl) — the content may be partial.
IMPORTANT: Ask for confirmation before any crawl exceeding 50 pages or a site outside the user's control.
YOU MUST respect robots.txt and the target site's ToS.
YOU MUST save outputs in ./scraped/<date>/ with timestamp for traceability.
NEVER bypass an anti-bot system without documented legitimate justification.
Firecrawl publishes its own skills in firecrawl/cli (13 skills, CLI v1.25.3). Not recommended next to this skill (checked 2026-10-04):
firecrawl-search claims "web research" and firecrawl-scrape "read a known webpage" — the same claim as the firecrawl router: installed, they route ordinary lookups to the paid API.firecrawl-search sends search feedback after every search, including text derived from the query (opt-out: FIRECRAWL_NO_SEARCH_FEEDBACK=1, separate from FIRECRAWL_NO_TELEMETRY=1)..firecrawl/ instead of ./scraped/<date>/, agent examples without --max-credits, pricing "not an extra confirmation gate".This skill's decision tree, free fallbacks, cost gates and legal rules only hold if it is the one that runs.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.