{"data":{"skill":{"slug":"firebase-firebase-ai-logic-basics","name":"firebase-ai-logic-basics","icon":"📦","repo":"https://github.com/firebase/agent-skills/tree/main/skills/firebase-ai-logic-basics/","status":"approved","author":"firebase","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"18fd3752-f138-474a-a044-56e4434fe2f0","skill_id":"7d860da7-9dbb-4e78-865f-6ab6ba6c77ad","version":2,"content_hash":"245c3719e58f76fb855804b53535e699","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"AI review found the static findings are false positives caused by Markdown documentation, fenced code examples, and Firebase documentation links. The CLI commands are setup instructions for Firebase projects, the network references point to official Firebase documentation, and the weak cryptography matches are keyword collisions on Gemini API text. No prompt injection, data exfiltration, credential harvesting, or malicious execution path was found.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":43,"line_start":31},{"file":"SKILL.md","line_end":102,"line_start":97},{"file":"references/flutter_setup.md","line_end":12,"line_start":7},{"file":"references/ios_setup.md","line_end":14,"line_start":6},{"file":"references/usage_patterns_android.md","line_end":12,"line_start":9},{"file":"references/usage_patterns_web.md","line_end":34,"line_start":5}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":25,"line_start":25},{"file":"SKILL.md","line_end":47,"line_start":47},{"file":"SKILL.md","line_end":84,"line_start":84},{"file":"SKILL.md","line_end":97,"line_start":93},{"file":"references/usage_patterns_android.md","line_end":22,"line_start":22}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[{"title":"False Positive: Markdown Setup Commands","locations":[{"file":"SKILL.md","line_end":43,"line_start":31},{"file":"SKILL.md","line_end":102,"line_start":97},{"file":"references/flutter_setup.md","line_end":12,"line_start":7},{"file":"references/usage_patterns_android.md","line_end":12,"line_start":9}],"confidence":0.97,"description":"Verdict: FALSE_POSITIVE. Static analysis flagged inline Markdown commands such as npm, npx, flutterfire, and SDK setup snippets. These are user-facing Firebase setup instructions, not hidden code that the skill executes.","confidence_reasoning":"The matched text appears inside Markdown documentation and fenced setup examples. No file contains Ruby code, shell wrappers, or an automatic execution path."},{"title":"False Positive: Firebase Documentation URLs","locations":[{"file":"SKILL.md","line_end":25,"line_start":25},{"file":"SKILL.md","line_end":47,"line_start":47},{"file":"SKILL.md","line_end":84,"line_start":84},{"file":"SKILL.md","line_end":97,"line_start":93},{"file":"references/usage_patterns_android.md","line_end":22,"line_start":22}],"confidence":0.96,"description":"Verdict: FALSE_POSITIVE. Static analysis flagged hardcoded URLs, but they are links to Firebase documentation and release notes. They do not transmit local data or secrets.","confidence_reasoning":"The URLs point to firebase.google.com documentation and are presented as references. No network client, webhook, or exfiltration behavior is present."},{"title":"False Positive: Weak Cryptography Keyword Match","locations":[{"file":"SKILL.md","line_end":3,"line_start":3},{"file":"references/ios_setup.md","line_end":125,"line_start":121}],"confidence":0.94,"description":"Verdict: FALSE_POSITIVE. Static analysis flagged weak cryptography on lines that discuss Gemini API usage and a sample stock symbol. No MD5, SHA-1, encryption routine, or password hashing code was found.","confidence_reasoning":"Manual review found API documentation text and a function parameter example, not cryptographic implementation. The scanner likely matched short tokens in prose or sample identifiers."},{"title":"False Positive: Prompt Injection Not Found","locations":[{"file":"SKILL.md","line_end":124,"line_start":1},{"file":"references/flutter_setup.md","line_end":83,"line_start":1},{"file":"references/ios_setup.md","line_end":144,"line_start":1},{"file":"references/usage_patterns_android.md","line_end":153,"line_start":1},{"file":"references/usage_patterns_web.md","line_end":175,"line_start":1}],"confidence":0.91,"description":"Verdict: FALSE_POSITIVE. Review looked for override language, fake system messages, pre-approval claims, and requests to skip analysis. No evidence found in the reviewed files.","confidence_reasoning":"Targeted search and contextual review did not find instruction override text. The files contain product guidance, warnings, and SDK examples within the stated skill scope."}],"dangerous_patterns":[],"files_scanned":5,"total_lines":679,"audit_model":"codex","audited_at":"2026-06-30T00:35:09.475+00:00","created_at":"2026-06-30T01:34:35.702933+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":4,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}