firebase
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides educational content and operational guidelines for Firebase development with a strong emphasis on security best practices, such as deny-by-default rules and proper credential management.
- [DATA_EXPOSURE]: The skill explicitly instructs agents and users to avoid hardcoding secrets or service account JSON files in client-side code or public repositories, adhering to secure development principles.
- [REMOTE_CODE_EXECUTION]: No remote code execution patterns or external downloads from untrusted sources were found. The provided Python utility script uses only standard libraries for local file analysis.
- [PROMPT_INJECTION]: No prompt injection or behavior override patterns were detected in the instructions.
- [INDIRECT_PROMPT_INJECTION]: The skill identifies a potential attack surface where it processes configuration files like
firestore.rules. However, the provided logic is a passive regex-based check with no high-privilege capabilities or dynamic execution of the analyzed data, presenting no significant risk.
Audit Metadata