firebase-basics

Pass

Audited by Gen Agent Trust Hub on Aug 30, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPERSISTENCE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches the official Firebase CLI (firebase-tools) from the NPM registry and downloads agent extensions from the firebase GitHub organization.
  • [COMMAND_EXECUTION]: Instructions guide the agent to use CLI tools for project initialization, authentication (firebase login), and application registration. It also utilizes dart pub for Flutter development tools and npm for SDK installation.
  • [PERSISTENCE]: The skill configures Model Context Protocol (MCP) servers in agent-specific configuration files (e.g., mcp_config.json, mcp.json) to provide persistent access to Firebase tools. It also provides standard instructions for updating shell profiles (.zshrc, .bashrc) to ensure Node.js and Flutter tools are correctly path-resolved.
  • [DATA_EXPOSURE]: The agent is instructed to read local configuration files like google-services.json and Info.plist to automate project linking. These operations are restricted to project-specific metadata necessary for the declared purpose of Firebase integration.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes project-level files (Xcode project structures and Android package names) to automate configuration. While this represents a data ingestion surface, the skill implements safety checkpoints by requiring the agent to pause and request user confirmation before creating projects or modifying existing configurations.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 30, 2026, 02:56 PM
Security Audit — agent-trust-hub — firebase-basics