The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill recommends a specific pattern for loading ESM-only dependencies: new Function("url", "return import(url)"). This technique is used to bypass build-time transpilation (like ts-node or TypeScript rewriting import() to require()) and execute dynamic imports at runtime. While this is a documented workaround for specific Node.js compatibility issues, using the Function constructor on dynamic strings is a sensitive pattern that could be exploited if the input 'url' were attacker-controlled.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to interact with external repository content (firebase-tools), including fetching branches, pulling changes, and managing dependencies. This introduces an attack surface where malicious instructions could be embedded in the repository (e.g., in package.json, CHANGELOG.md, or source code) and processed by the agent.
Ingestion points: Reads files and git metadata from the firebase/firebase-tools repository.
Boundary markers: None mentioned; the agent processes repository content as trusted development context.
Capability inventory: The skill has broad capabilities including file writes, git commands, npm scripts, and gh CLI operations.
Sanitization: No specific sanitization or validation of the repository content is described.
[COMMAND_EXECUTION]: The skill provides instructions for executing various shell commands, including git, npm, npx, and gh. These are standard for development workflows but grant the agent the ability to execute arbitrary commands within the repository environment.

developing-firebase-tools