firebase-app-hosting-basics
Pass
Audited by Gen Agent Trust Hub on May 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches and executes the official firebase-tools package from the npm registry using the npx command. This is a standard and safe way to use the Firebase CLI.\n- [COMMAND_EXECUTION]: Utilizes firebase-tools CLI commands to perform various operations, including deploying applications, managing backends, and initiating rollouts. These commands are integral to the stated purpose of the skill.\n- [PROMPT_INJECTION]:\n
- Ingestion points: The skill reads configuration data from project-level files, specifically firebase.json (SKILL.md), apphosting.yaml (references/configuration.md), and apphosting.emulator.yaml (references/emulation.md).\n
- Boundary markers: No explicit boundary markers or instructions to ignore embedded instructions are present when processing these configuration files.\n
- Capability inventory: The skill executes shell commands using npx -y firebase-tools to deploy, manage backends, and handle secrets (references/cli_commands.md).\n
- Sanitization: No specific sanitization of the configuration file content is mentioned before it is processed by the Firebase CLI tool.\n- [SAFE]: The skill documents best practices for security, such as using the firebase-tools apphosting:secrets command to manage sensitive keys in Cloud Secret Manager and recommending that emulator-specific configuration files containing local secrets should be gitignored.
Audit Metadata