File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- dist/firecrawl-fetch-provider-CIpxLKLq.js:38
- Evidence
const apiKey = [REDACTED])?.webSearch?.apiKey;
Security audit
OpenClaw Firecrawl Plugin
Security checks for vulnerabilities and agentic risk
Overview
This plugin coherently adds Firecrawl-powered web search and page scraping, with expected network and API-key use disclosed in its metadata.
Install only if you are comfortable routing web searches and scrape targets through Firecrawl or your configured self-hosted Firecrawl endpoint. Treat the Firecrawl API key as sensitive, and disable scrape cache storage for requests involving private or sensitive URLs/content.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
Detected: suspicious.exposed_secret_literal