firebase-ai-logic-basics
Fail
Audited by Gen Agent Trust Hub on May 19, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs developers to install packages such as 'firebase_ai' (Flutter/Android) and 'FirebaseAILogic' (iOS), which do not correspond to the official Firebase SDK names (e.g., 'firebase_vertexai'). This impersonation poses a significant supply chain risk, as it encourages the use of unverified third-party code in place of official libraries.
- [COMMAND_EXECUTION]: The skill provides CLI commands such as 'npx -y firebase-tools@latest init ailogic'. While the utility is legitimate, the 'ailogic' feature is not a standard part of the official CLI. The use of deceptive subcommands combined with flags that bypass confirmation could be used to trigger unintended behavior in a development environment.
Recommendations
- AI detected serious security threats
Audit Metadata