firebase-cli

Pass

Audited by Gen Agent Trust Hub on Jul 30, 2026

Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The installation process provided in scripts/install.sh and the documentation fetches the official Firebase CLI installer from https://firebase.tools and pipes it to bash. This is the official and standard installation method for a well-known service provided by Google.
  • [COMMAND_EXECUTION]: The helper scripts scripts/deploy.sh and scripts/emulators.sh use the eval command to execute shell strings constructed from user-supplied arguments. While this is a standard design for CLI wrapper scripts, it presents a minor command execution surface if the input arguments are not properly handled by the calling agent.
  • [SAFE]: No evidence of malicious obfuscation, persistence mechanisms, or unauthorized data exfiltration was detected. The skill correctly advises users to manage credentials via environment variables and to keep sensitive files out of version control.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 30, 2026, 01:49 AM
Security Audit — agent-trust-hub — firebase-cli