web-scraping — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited web-scraping (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Extract LLM-ready web content without hacking around: clean markdown, structured JSON, anti-bot and JS-rendering handled. Firecrawl is the reference wrapper; fallback to Playwright or curl + html2text if unavailable.
WebSearch is enoughWebFetch is enoughqa-chrome or agent-browserexport FIRECRAWL_API_KEY="fc-xxx" # https://firecrawl.dev
npm install -g firecrawl # or pip install firecrawl-pyDocker compose available on github.com/mendableai/firecrawl. Useful if data is sensitive or budget is limited.
If Firecrawl is missing, degrade gracefully:
| Need | Fallback | Limitation | |
|---|---|---|---|
| Simple static page | `curl -sL URL \ | pandoc -f html -t markdown` | No JS rendering |
| JS-heavy page | npx playwright + page.content() + markdownify | Heavy, 300MB+ of deps | |
| Whole site | recursive filtered wget | No deduplication, no LLM-ready output |
IMPORTANT: always announce when degrading. The user must know if the content is partial (JS not rendered).
firecrawl scrape https://example.com/article \
--formats markdown,links \
--only-main-contentOutput: clean markdown (navigation / footers stripped), list of links, OG metadata.
firecrawl crawl https://docs.example.com \
--limit 100 \
--include-paths "/docs/**" \
--exclude-paths "/docs/legacy/**" \
--formats markdownOutput: one markdown per page + JSON manifest. Ask for confirmation before crawl > 50 pages (API costs + time).
firecrawl map https://example.com --search "pricing"Output: list of relevant URLs. Useful BEFORE a crawl to target the right sections.
firecrawl extract https://example.com/pricing \
--prompt "Extract plans with name, price, features" \
--schema '{"plans":[{"name":"str","price":"num","features":["str"]}]}'Output: JSON conforming to the schema. Saves hours of fragile CSS selectors.
firecrawl search "best pve proxmox backup strategies" \
--limit 10 \
--scrape-options '{"formats":["markdown"]}'Output: top N results with extracted content. Replaces WebSearch + N WebFetch.
1. IDENTIFY the need
- 1 page -> scrape
- N known pages -> scrape in a loop with `xargs -P 4`
- Whole site -> map (recon) -> targeted crawl
- Structured data -> extract with schema
- Search + extract -> search
2. ESTIMATE costs
- Firecrawl cloud: credits per page scraped
- Ask for confirmation if > 50 pages or > 10 MB expected
3. RUN with limits on the first attempt
- --limit 5 to test
- Inspect the output
- Re-run at full volume if OK
4. SAVE the result
- `./scraped/<date>/<domain>.md` by convention
- Commit if data is reusable (mind copyright)
5. CHECK legality / ethics
- Respect robots.txt unless explicitly authorized
- No personal data without consent (GDPR)
- No commercial paywall bypassfirecrawl crawl https://docs.terraform.io/language \
--limit 200 --formats markdown \
--output-dir ./rag-corpus/terraformfor url in url1 url2 url3 url4 url5; do
firecrawl extract "$url" \
--prompt "Extract pricing plans" \
--schema pricing.schema.json >> pricing-compared.jsonl
donefirecrawl scrape https://example.com/changelog \
--formats markdown \
| diff - last-changelog.md \
&& mv <(firecrawl scrape ...) last-changelog.md| Signal | Reaction |
|---|---|
Missing FIRECRAWL_API_KEY AND firecrawl self-hosted not detected | Propose explicit fallback, ask the user for their choice |
robots.txt forbids scraping the target path | STOP — ask for explicit authorization before continuing |
| More than 100 pages without confirmation | STOP — announce estimated costs and wait for validation |
| Personal data detected (email, phone, ID) in the output | STOP — do not save without GDPR legal basis |
| Site with login / commercial paywall | STOP — scraping illegal except with explicit contract |
| Repeated 429 rate limit | STOP — exponential backoff, do not hammer |
| Combo | Usage |
|---|---|
web-scraping -> dev:dev-rag | Build a corpus for RAG ingestion |
web-scraping -> biz:biz-competitor | Factual competitive & market analysis on real data |
web-scraping + writing-skills | Import third-party lib docs into a local skill |
qa-chrome instead of web-scraping | Visual tests, DOM interaction, screenshots |
WebSearch for a simple factual question (needlessly expensive)IMPORTANT: Always announce when degrading to a fallback (Playwright / curl) — the content may be partial.
IMPORTANT: Ask for confirmation before any crawl exceeding 50 pages or a site outside the user's control.
YOU MUST respect robots.txt and the target site's ToS.
YOU MUST save outputs in ./scraped/<date>/ with timestamp for traceability.
NEVER bypass an anti-bot system without documented legitimate justification.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.