firebase-admin-sdk-server-integration
Pass
Audited by Gen Agent Trust Hub on Mar 31, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes official Node.js packages such as firebase-admin and server-only. These are maintained by well-known technology organizations and represent standard, safe dependencies for this integration.
- [SAFE]: Instructions for storing the Firebase private key and client email in .env.local files align with industry-standard secret management practices. This prevents credentials from being hardcoded or committed to version control systems.
- [PROMPT_INJECTION]: The skill identifies a surface for indirect prompt injection in the custom claims code example where untrusted data from request.json() is used to modify user permissions.
- Ingestion points: request.json() in the set-role API route (app/api/admin/set-role/route.ts)
- Boundary markers: Absent in the illustrative code snippet
- Capability inventory: adminAuth.setCustomUserClaims (privileged account modification)
- Sanitization: Absent in the provided snippet; the example demonstrates functionality but relies on the developer to implement strict schema validation for uid and role fields.
Audit Metadata