firebase-app-hosting-basics
Pass
Audited by Gen Agent Trust Hub on Apr 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the Firebase CLI to perform administrative and deployment tasks for web applications.
- Evidence:
npx -y firebase-tools@latest deployand other management commands inSKILL.mdandreferences/cli_commands.md. - [EXTERNAL_DOWNLOADS]: The skill downloads and executes the official
firebase-toolspackage from the npm registry usingnpx. - Evidence: Consistent use of
npx -y firebase-tools@latestacross documentation to ensure tool availability. - [PROMPT_INJECTION]: The skill processes project configuration files, which serves as a potential surface for indirect prompt injection if those files are modified by untrusted parties.
- Ingestion points:
firebase.json(SKILL.md) andapphosting.yaml(references/configuration.md). - Boundary markers: Implicitly handled by standard JSON/YAML parsers.
- Capability inventory: Subprocess execution via
firebase-toolsfor resource management and deployment. - Sanitization: Input validation is performed by the underlying Firebase CLI tool.
Audit Metadata