firebase-basics
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPERSISTENCE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches the official Firebase CLI (
firebase-tools) from the NPM registry and downloads agent extensions from thefirebaseGitHub organization. - [COMMAND_EXECUTION]: Instructions guide the agent to use CLI tools for project initialization, authentication (
firebase login), and application registration. It also utilizesdart pubfor Flutter development tools andnpmfor SDK installation. - [PERSISTENCE]: The skill configures Model Context Protocol (MCP) servers in agent-specific configuration files (e.g.,
mcp_config.json,mcp.json) to provide persistent access to Firebase tools. It also provides standard instructions for updating shell profiles (.zshrc,.bashrc) to ensure Node.js and Flutter tools are correctly path-resolved. - [DATA_EXPOSURE]: The agent is instructed to read local configuration files like
google-services.jsonandInfo.plistto automate project linking. These operations are restricted to project-specific metadata necessary for the declared purpose of Firebase integration. - [INDIRECT_PROMPT_INJECTION]: The skill processes project-level files (Xcode project structures and Android package names) to automate configuration. While this represents a data ingestion surface, the skill implements safety checkpoints by requiring the agent to pause and request user confirmation before creating projects or modifying existing configurations.
Audit Metadata