firebase-apk-scanner

SUSPICIOUS. The stated purpose and official Firebase data flows are coherent for a security-audit skill, and there is no evidence of credential harvesting, third-party proxying, or malicious pre-execution. However, the referenced bundled scanner.sh is not provided for review, so core execution behavior is partially unverifiable, and the skill performs active offensive security testing against live targets; that makes it high-risk in operation and not suitable outside explicit authorization.

The code is a legitimate-looking Firebase security scanner and contains no clear malware, persistence, exfiltration, or host compromise behavior. It does perform active network reconnaissance and modifies remote Firebase resources by creating accounts and writing test data. It also stores authentication tokens in local reports and insufficiently validates APK-derived URL components. Use only with authorization, isolate and protect generated reports, and improve input validation and cleanup handling.