firebase-ai-logic
Pass
Audited by Gen Agent Trust Hub on Mar 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: The skill integrates with official Firebase services and points to verified Google domains for documentation and setup instructions.
- [EXTERNAL_DOWNLOADS]: Downloads the official Firebase CLI and SDK using the command
npm install -g firebase@latestfrom the public NPM registry. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input such as text prompts and media files (images, audio, video, PDF) through functions like
generateTextandanalyzeImage. - Ingestion points: User-provided strings and file objects in
references/usage_patterns_web.md. - Boundary markers: Not present in the simplified code examples.
- Capability inventory: Limited to network requests to the Gemini API via the Firebase SDK; no access to local files, system shells, or sensitive environment variables is requested.
- Sanitization: Not demonstrated in the example snippets, though the use of Firebase App Check is recommended to secure the client-side API usage.
Audit Metadata