firebase-appcheck-manager
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues detected. The skill acts as a technical manual for configuring Firebase App Check.
- [COMMAND_EXECUTION]: The skill provides various shell scripts and Python one-liners. These are used for legitimate development tasks such as fetching configuration, parsing JSON responses from official APIs, and generating debug tokens using the standard
uuidlibrary. - [EXTERNAL_DOWNLOADS]: All network operations (via
curl) target trusted and well-known Google API domains (firebaseappcheck.googleapis.com,firebase.googleapis.com,playintegrity.googleapis.com). Per the security guidelines, these interactions with trusted services are considered safe. - [CREDENTIALS_SAFE]: While the skill involves managing sensitive assets like Apple DeviceCheck private keys (.p8 files) and Firebase debug tokens, it provides correct guidance on uploading them to the official Firebase backend and does not attempt to exfiltrate them to untrusted third parties. It explicitly warns users to keep these files secure and not to commit them to version control.
Audit Metadata