firebase
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines patterns for handling data from external sources, which creates a potential surface for indirect prompt injection if the ingested data is later processed by an agent without sanitization.
- Ingestion points: External data enters the system through
SKILL.mdvia theMyFirebaseMessagingService.onMessageReceivedfunction (which handles FCM notification payloads) and theItemFirestoreDataSourceclass (which streams documents from a remote database). - Boundary markers: Absent. The provided code does not include specific delimiters or instructional wrappers to distinguish untrusted external data from system instructions.
- Capability inventory: The skill provides capabilities for Firebase authentication, Firestore CRUD (Create, Read, Update, Delete) operations, and Cloud Messaging. It does not include high-risk capabilities such as arbitrary shell execution, local file system modification, or network requests to arbitrary domains.
- Sanitization: Absent. The implementation snippets do not include data validation or escaping logic for the content received from FCM or Firestore before it is passed to handlers or repositories.
Audit Metadata