firebase-ai-logic-basics
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill includes instructions to download the Firebase CLI and SDKs using standard package managers including npm (
firebase,firebase-tools) and Flutter's pub (firebase_core,firebase_auth,firebase_ai). These resources originate from the vendor's official repositories and registries. - [COMMAND_EXECUTION]: The skill uses
npxto execute Firebase CLI tools for project initialization, listing projects, and listing associated apps. These commands are essential for the stated purpose of setting up Firebase AI Logic services. - [INDIRECT_PROMPT_INJECTION]: The skill provides patterns for passing user-controlled data into AI models via functions like
generateContent(prompt). While this creates an injection surface, the skill explicitly provides remediation guidance by mandating the use of Firebase App Check to ensure only authorized clients can access the backend resources. - [CREDENTIALS_UNSAFE]: The documentation references App Check debug tokens and provides a standard example UUID for illustrative purposes. It correctly instructs users to store actual production tokens as encrypted secrets within their CI/CD environments rather than hardcoding them in source files.
Audit Metadata