firebase-messaging
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches official Firebase SDK compatibility scripts from the gstatic.com domain for web implementations.
- [INDIRECT_PROMPT_INJECTION]: The skill implements handlers for incoming notification data, creating an ingestion point for external content. 1. Ingestion points: onMessage, onBackgroundMessage, and getInitialMessage listeners in SKILL.md. 2. Boundary markers: None present in the provided snippets. 3. Capability inventory: The handlers demonstrate logging and Firebase initialization logic. 4. Sanitization: Examples do not show explicit validation or sanitization of notification payload content, which is typical for library usage documentation.
Audit Metadata