The Agent Skills Directory

[COMMAND_EXECUTION]: Utility scripts such as scripts/deploy.sh, scripts/deploy_functions.sh, scripts/export_firestore.sh, and scripts/import_firestore.sh utilize the shell eval command to execute strings constructed from concatenated variables. This pattern is dangerous as it allows for arbitrary command execution if variables (such as deployment messages or file paths) are manipulated to include shell metacharacters.
Evidence in scripts/deploy.sh: eval $CMD where $CMD includes the $MESSAGE variable derived from user-provided arguments.
Evidence in scripts/export_firestore.sh: eval $CMD where $CMD includes $BUCKET and $COLL_FLAGS derived from command-line options.
[PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection (Category 8) because it reads and processes local project files without proper isolation or sanitization.
Ingestion points: Files within the Firebase project directory, including source code and configurations, are accessed using Read, Glob, and Grep tools.
Boundary markers: None. There are no instructions provided to the agent to treat file content as untrusted data or to ignore instructions embedded within those files.
Capability inventory: The skill has access to powerful tools including Bash for command execution, Write and Edit for file system modification, and WebFetch for network requests.
Sanitization: None. Data extracted from project files is used directly by the agent to determine logic and tool parameters.
[EXTERNAL_DOWNLOADS]: The scripts/setup_python_functions.py script configures the project to retrieve dependencies from official package registries. It generates a requirements.txt file specifying standard Google and Firebase libraries like firebase-functions and firebase-admin.

using-firebase