firebase-firestore-enterprise-native-mode
Pass
Audited by Gen Agent Trust Hub on Apr 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill documentation describes the use of the Firebase CLI for administrative tasks, such as creating databases (
firebase firestore:databases:create) and deploying configurations (firebase deploy --only firestore). These are standard operational commands for Firebase management. - [EXTERNAL_DOWNLOADS]: The skill references and encourages the use of official, well-known libraries and tools from Google and Firebase, including the
firebase-toolsCLI and the Firestore SDKs for Python and Web. These are trusted dependencies maintained by a well-known service provider. - [PROMPT_INJECTION]: The file
references/security_rules.mdcontains extensive persona-based instructions ('You are an expert Firebase Security Rules engineer') and behavioral directives designed to guide the agent through a secure code generation process. While these instructions steer the agent's behavior, they do so to enforce security standards rather than to bypass safety guardrails or exfiltrate information. - [INDIRECT_PROMPT_INJECTION]: The skill includes a surface for indirect prompt injection by instructing the agent to scan a user's codebase to inform security rule generation.
- Ingestion points: The agent reads user codebase files as described in Phase-1 of
references/security_rules.md. - Boundary markers: No specific boundary markers or 'ignore' instructions are provided for the scanned content.
- Capability inventory: The agent has the capability to write and update the
firestore.rulesconfiguration file. - Sanitization: The instructions provide mitigation through a mandatory 'Phase-3: Devil's Advocate Attack' step, where the agent must systematically attempt to exploit the rules it just generated.
Audit Metadata