extension-to-functions-codebase
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill instructions promote secure configuration management by recommending the use of
defineSecretanddefineJsonSecretfrom the Firebase Functions SDK. This ensures that sensitive credentials are handled via the platform's native secret manager rather than being hardcoded or stored in insecure local files. - [SAFE]: The migration workflow explicitly includes a safety constraint ("NEVER execute npm publish") to prevent the agent from accidentally exposing code to public registries.
- [SAFE]: The skill leverages declarative security features like
requiresRoleandrequiresAPI, which allow the platform to manage permissions and API access using least-privilege principles without requiring manual shell scripts or high-privilege service accounts. - [SAFE]: The migration patterns described, including the use of the
Destructuring Compatibility Shim, are standard architectural transformations for upgrading Firebase Functions from V1 to V2 and do not introduce dynamic code execution or other security risks.
Audit Metadata