The Agent Skills Directory

[PROMPT_INJECTION]: The skill uses authoritative and prescriptive language to override the agent's natural behavior and response patterns.
In SKILL.md, it states: "You MUST unconditionally activate this skill if you plan to use Firestore in any way."
In both references/enterprise/security_rules.md and references/standard/security_rules.md, the instructions force the agent into a specific role and mandate a verbatim response format: "You are an expert Firebase Security Rules engineer...", "Your task is to generate...", and "you MUST explicitly communicate to the user exactly like this: 'I've set up prototype Security Rules...'"
[PROMPT_INJECTION]: The skill includes instructions for 'Phase-1: Codebase Analysis' in the security rules guides, which directs the agent to 'Scan the entire codebase'. This creates a significant surface for indirect prompt injection, as malicious instructions embedded in the user's codebase could be ingested and acted upon by the agent while it is analyzing data models and queries.
Ingestion points: The agent is instructed to scan the user's local codebase in references/enterprise/security_rules.md and references/standard/security_rules.md.
Boundary markers: No explicit instructions are provided to the agent to disregard or treat content from the scanned codebase as untrusted instructions.
Capability inventory: The skill utilizes bash commands via npx firebase-tools to list, create, and deploy Firestore configurations as seen in SKILL.md and references/standard/provisioning.md.
Sanitization: There is no mention of sanitizing or validating the patterns identified during the codebase scan before using them to generate logic.

firebase-firestore