The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a bootstrap shell script to automate the creation and configuration of Google Cloud projects, service accounts, and IAM policies. This involves significant shell interaction, which is handled using best practices like variable quoting and a safety valve that prevents execution with unconfigured placeholders.
[EXTERNAL_DOWNLOADS]: The documentation and scripts invoke npx firebase-tools. Security is significantly enhanced by pinning the version to an exact semver (e.g., 15.27.0) and including instructions to verify the package source and publication time, mitigating risks associated with malicious package updates.
[DATA_EXPOSURE]: The skill manages sensitive service account keys. It minimizes exposure by creating temporary local files that are immediately deleted after being securely uploaded to GitHub Secrets. It further tracks issued keys via the service account's description field in GCP, ensuring the script only rotates keys it has created and doesn't interfere with unrelated credentials.
[INDIRECT_PROMPT_INJECTION]: The skill ingests user-defined parameters such as project and site IDs. It demonstrates awareness of injection risks by using shell-safe quoting for messages and environment variable passing for GitHub Actions workflows to prevent command injection at the orchestration level.

setup-firebase-hosting