firebase-security

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs the agent to extract API keys/project IDs and to echo/save raw database/function responses (e.g., printing RTDB/Firestore outputs and leaked service-account JSON), which requires including secret values verbatim in output.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This skill contains explicit, actionable offensive techniques (unauthorized data retrieval via REST API, saving exfiltrated outputs, testing Cloud Functions for privilege escalation, unauthenticated storage uploads, and instructions to hunt for leaked service-account JSON) and even mandates proceeding without further authorization, making it high-risk and readily abuseable for data exfiltration, credential theft, and remote compromise.