firebase-basics

SUSPICIOUS: The skill's Firebase-focused capabilities mostly fit its stated purpose and use official ecosystems, so there is no clear malicious exfiltration pattern. However, it unnecessarily mandates transitive skill installation and repeatedly executes unpinned `npx @latest` commands, creating medium supply-chain and trust-chain risk disproportionate to a basic reference skill.