{"data":{"skill":{"slug":"firebase-firebase-auth-basics","name":"firebase-auth-basics","icon":"📦","repo":"https://github.com/firebase/agent-skills/tree/main/skills/firebase-auth-basics/","status":"approved","author":"firebase","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"0cd70620-79ef-4999-ae47-9442c594e816","skill_id":"92adaa07-d122-4532-a75c-c2440a852fff","version":4,"content_hash":"v3:30c73eac2afe762f6aa9c4553158769369d47351:de0aaf00fe6c4a512d6574203574981991a15f957cab9fb20bd7d61b7dd667f2:2b42b79b2f7146049288c01c17373700414f728cd01f180e8fa8c402758a37f5:736b696c6c732f66697265626173652f66697265626173652d617574682d626173696373:9831924790a24607ad0507270758ab02","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"The static findings are false positives caused by Markdown inline code, sample Firebase configuration, localhost emulator URLs, and official Firebase documentation links. I found no evidence of prompt injection, credential exfiltration, hidden execution, or malicious network behavior in the reviewed files.","remediation":[],"risk_factor_evidence":[{"factor":"network","evidence":[{"file":"references/client_sdk_web.md","line_end":25,"line_start":25},{"file":"references/client_sdk_web.md","line_end":217,"line_start":217},{"file":"references/client_sdk_web.md","line_end":266,"line_start":266},{"file":"SKILL.md","line_end":62,"line_start":62},{"file":"SKILL.md","line_end":73,"line_start":73}]},{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":4,"line_start":4},{"file":"SKILL.md","line_end":9,"line_start":9},{"file":"SKILL.md","line_end":10,"line_start":10},{"file":"SKILL.md","line_end":18,"line_start":18},{"file":"SKILL.md","line_end":20,"line_start":20},{"file":"SKILL.md","line_end":21,"line_start":21},{"file":"SKILL.md","line_end":22,"line_start":22},{"file":"SKILL.md","line_end":23,"line_start":23},{"file":"SKILL.md","line_end":24,"line_start":24},{"file":"SKILL.md","line_end":51,"line_start":51},{"file":"SKILL.md","line_end":67,"line_start":53},{"file":"SKILL.md","line_end":84,"line_start":67}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":3,"total_lines":414,"audit_model":"codex","audited_at":"2026-07-05T16:08:06.351+00:00","created_at":"2026-07-17T16:31:09.539876+00:00","static_findings":[{"id":"network:references/client_sdk_web.md:25:hardcoded-url","file":"references/client_sdk_web.md","pattern":"Hardcoded URL","snippet":"connectAuthEmulator(auth, \"http://localhost:9099\");","category":"network","line_end":25,"severity":"low","line_start":25},{"id":"network:references/client_sdk_web.md:217:hardcoded-url","file":"references/client_sdk_web.md","pattern":"Hardcoded URL","snippet":"url: 'https://www.example.com/finishSignUp?cartId=1234',","category":"network","line_end":217,"severity":"low","line_start":217},{"id":"network:references/client_sdk_web.md:266:hardcoded-url","file":"references/client_sdk_web.md","pattern":"Hardcoded URL","snippet":"// https://firebase.google.com/docs/reference/js/firebase.User","category":"network","line_end":266,"severity":"low","line_start":266},{"id":"blocker:references/client_sdk_web.md:24:system-reconnaissance","file":"references/client_sdk_web.md","pattern":"System reconnaissance","snippet":"if (location.hostname === \"localhost\") {","category":"blocker","line_end":24,"severity":"low","line_start":24},{"id":"blocker:references/client_sdk_web.md:267:system-reconnaissance","file":"references/client_sdk_web.md","pattern":"System reconnaissance","snippet":"const uid = user.uid;","category":"blocker","line_end":267,"severity":"low","line_start":267},{"id":"blocker:references/security_rules.md:18:system-reconnaissance","file":"references/security_rules.md","pattern":"System reconnaissance","snippet":"allow read, write: if request.auth != null && request.auth.uid == userId;","category":"blocker","line_end":18,"severity":"low","line_start":18},{"id":"blocker:references/security_rules.md:25:system-reconnaissance","file":"references/security_rules.md","pattern":"System reconnaissance","snippet":"allow read, write: if request.auth != null && request.auth.uid == resource.data.owner_uid;","category":"blocker","line_end":25,"severity":"low","line_start":25},{"id":"external_commands:SKILL.md:4:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"compatibility: This skill is best used with the Firebase CLI, but does not require it. Firebase CLI ","category":"external_commands","line_end":4,"severity":"medium","line_start":4},{"id":"external_commands:SKILL.md:9:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Firebase Project**: Created via `npx -y firebase-tools@latest projects:create` (see `firebase-ba","category":"external_commands","line_end":9,"severity":"medium","line_start":9},{"id":"external_commands:SKILL.md:10:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Firebase CLI**: Installed and logged in (see `firebase-basics`).","category":"external_commands","line_end":10,"severity":"medium","line_start":10},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"A user is an entity that can sign in to your app. Each user is identified by a unique ID (`uid`) whi","category":"external_commands","line_end":18,"severity":"medium","line_start":18},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `uid`: Unique identifier.","category":"external_commands","line_end":20,"severity":"medium","line_start":20},{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `email`: User's email address (if available).","category":"external_commands","line_end":21,"severity":"medium","line_start":21},{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `displayName`: User's display name (if available).","category":"external_commands","line_end":22,"severity":"medium","line_start":22},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `photoURL`: URL to user's photo (if available).","category":"external_commands","line_end":23,"severity":"medium","line_start":23},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `emailVerified`: Boolean indicating if the email is verified.","category":"external_commands","line_end":24,"severity":"medium","line_start":24},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Configure Firebase Authentication in `firebase.json` by adding an 'auth' block:","category":"external_commands","line_end":51,"severity":"medium","line_start":51},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":67,"severity":"medium","line_start":53},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":84,"severity":"medium","line_start":67},{"id":"network:SKILL.md:62:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"authorizedRedirectUris\": [\"https://example.com\"]","category":"network","line_end":62,"severity":"low","line_start":62},{"id":"network:SKILL.md:73:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"1.  Go to the https://console.firebase.google.com/project/_/authentication/providers","category":"network","line_end":73,"severity":"low","line_start":73}],"finding_verdicts":[{"id":"network:references/client_sdk_web.md:25:hardcoded-url","reason":"The URL points to the local Firebase Auth emulator and is guarded by a localhost check. It does not contact an external service or exfiltrate data.","verdict":"false_positive","confidence":0.96},{"id":"network:references/client_sdk_web.md:217:hardcoded-url","reason":"The URL is an example redirect for Firebase email-link authentication. It is placeholder documentation, not a live collection endpoint or hidden network request.","verdict":"false_positive","confidence":0.95},{"id":"network:references/client_sdk_web.md:266:hardcoded-url","reason":"This is a Firebase documentation URL inside a comment. It is not executable code and does not transmit user data.","verdict":"false_positive","confidence":0.98},{"id":"blocker:references/client_sdk_web.md:24:system-reconnaissance","reason":"The hostname check only detects local development so the sample can connect to the Auth emulator. It is not system reconnaissance or environment probing for abuse.","verdict":"false_positive","confidence":0.95},{"id":"blocker:references/client_sdk_web.md:267:system-reconnaissance","reason":"Reading user.uid is normal Firebase Auth state handling for the signed-in user. The sample does not enumerate accounts or inspect the host system.","verdict":"false_positive","confidence":0.97},{"id":"blocker:references/security_rules.md:18:system-reconnaissance","reason":"The rule compares request.auth.uid to a path variable for access control. This is expected Firebase Security Rules logic, not reconnaissance.","verdict":"false_positive","confidence":0.97},{"id":"blocker:references/security_rules.md:25:system-reconnaissance","reason":"The rule checks ownership through resource.data.owner_uid before allowing access. This is a defensive authorization pattern, not system reconnaissance.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:4:ruby-shell-backtick-execution","reason":"The backticks are Markdown formatting around an optional Firebase CLI command. The skill does not execute the command automatically or inject user input into it.","verdict":"false_positive","confidence":0.86},{"id":"external_commands:SKILL.md:9:ruby-shell-backtick-execution","reason":"The line documents a Firebase CLI project-creation command for a user to run deliberately. It is not runtime shell execution by the skill.","verdict":"false_positive","confidence":0.84},{"id":"external_commands:SKILL.md:10:ruby-shell-backtick-execution","reason":"The inline code marks the name of another skill in prose. There is no shell command, subprocess call, or dynamic execution path.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","reason":"The backticks format the Firebase user identifier field name. This is documentation text and contains no executable command.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","reason":"The inline code marks the uid property name in a user-property list. It does not represent shell execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","reason":"The inline code marks the email property name in documentation. No command execution or unsafe evaluation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","reason":"The inline code marks the displayName property name. This is a Markdown formatting false positive, not executable code.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","reason":"The inline code marks the photoURL property name. It is documentation text and creates no execution risk.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","reason":"The inline code marks the emailVerified property name. No shell command or Ruby backtick execution exists in this line.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","reason":"The backticks format the firebase.json filename. The line introduces a configuration example and does not execute anything.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","reason":"This is the opening Markdown fence for a Firebase configuration example. A code fence marker is not command execution.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","reason":"This is a Markdown fence around documentation content and workflow text. It is not a Ruby backtick operator or shell execution primitive.","verdict":"false_positive","confidence":0.96},{"id":"network:SKILL.md:62:hardcoded-url","reason":"The URL is a placeholder authorized redirect URI in sample Firebase configuration. It is not a hidden callback or data-exfiltration endpoint.","verdict":"false_positive","confidence":0.94},{"id":"network:SKILL.md:73:hardcoded-url","reason":"The URL points to the official Firebase Console provider settings page. It is a navigation instruction, not an unauthorized network operation.","verdict":"false_positive","confidence":0.97}],"semantic_findings":[],"subject_marketplace_commit_sha":"30c73eac2afe762f6aa9c4553158769369d47351","subject_content_hash":"de0aaf00fe6c4a512d6574203574981991a15f957cab9fb20bd7d61b7dd667f2","subject_tree_hash":"2b42b79b2f7146049288c01c17373700414f728cd01f180e8fa8c402758a37f5","subject_plugin_path":"skills/firebase/firebase-auth-basics","audit_payload_hash":"9831924790a24607ad0507270758ab02","confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":"30c73eac2afe762f6aa9c4553158769369d47351","contentHash":"de0aaf00fe6c4a512d6574203574981991a15f957cab9fb20bd7d61b7dd667f2","treeHash":"2b42b79b2f7146049288c01c17373700414f728cd01f180e8fa8c402758a37f5","pluginPath":"skills/firebase/firebase-auth-basics","auditPayloadHash":"9831924790a24607ad0507270758ab02"},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":true}}