firebase-firestore
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides standard boilerplate for Firebase Firestore initialization using environment variables (
process.env), which is the recommended practice for secret management. - [SAFE]: Instructions correctly distinguish between Client SDK (public context) and Admin SDK (privileged server context), with explicit warnings against exposing the Firebase Private Key in client-side code.
- [SAFE]: The provided security rules template implements a default-deny policy (
match /{document=**} { allow read, write: if false; }), which is a security best practice for Firestore. - [SAFE]: All external documentation links point to official Google/Firebase documentation domains.
- [SAFE]: Dependencies (
firebase,firebase-admin) are well-known, official packages from Google.
Audit Metadata