firebase-basics

SUSPICIOUS rather than malicious. The skill’s Firebase-focused capabilities mostly match its stated purpose and use official Firebase/Node tooling, but the mandatory installation of another skill through the third-party `skills` CLI creates disproportionate transitive trust for a basic setup guide. Main risk is supply-chain and inherited-permissions exposure, not confirmed credential theft or covert exfiltration.