firebase-storage
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues detected. The skill provides standard implementation patterns for Firebase Storage and explicitly warns against insecure practices like exposing Admin SDK credentials in client-side code.
- [CREDENTIALS_UNSAFE]: The skill correctly instructs users to use environment variables for sensitive credentials such as API keys and private keys. It provides a specific fix for private key newline formatting, which is a common configuration requirement rather than a security risk.
- [EXTERNAL_DOWNLOADS]: The dependencies mentioned (firebase, firebase-admin) are official packages. The skill does not perform any unauthorized remote downloads or script executions.
- [PROMPT_INJECTION]: No instructions were found that attempt to bypass AI safety guidelines or override system prompts.
- [INDIRECT_PROMPT_INJECTION]: The skill documents defensive measures against indirect injection, including client-side validation and server-side security rules to enforce file type and size constraints, effectively mitigating risks from processing untrusted user uploads.
Audit Metadata