{"data":{"skill":{"slug":"firebase-firebase-basics","name":"firebase-basics","icon":"📦","repo":"https://github.com/firebase/agent-skills/tree/main/skills/firebase-basics/","status":"approved","author":"firebase","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"d555f961-2aad-4fec-a392-98f7c55bf4d6","skill_id":"ee7d93b2-6f71-43c2-ba19-1b581ad8c871","version":2,"content_hash":"85b53620bca759197dbac57b28bc3a9f","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"Static findings are mostly true positives for documented command execution, network access, filesystem configuration, and Firebase API key placeholders, but most are legitimate for a Firebase setup skill. Human review is still required because the skill contains prompt-control language and instructs agents to install remote packages and modify local AI agent configuration files.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"references/firebase-cli-guide.md","line_end":8,"line_start":6},{"file":"references/firebase-cli-guide.md","line_end":11,"line_start":8},{"file":"references/firebase-cli-guide.md","line_end":16,"line_start":11},{"file":"references/firebase-project-create.md","line_end":7,"line_start":5},{"file":"references/firebase-service-init.md","line_end":3,"line_start":3},{"file":"references/firebase-service-init.md","line_end":7,"line_start":7},{"file":"references/firebase-service-init.md","line_end":13,"line_start":11},{"file":"references/firebase-service-init.md","line_end":18,"line_start":13},{"file":"references/firebase-service-init.md","line_end":18,"line_start":18},{"file":"references/local-env-setup.md","line_end":6,"line_start":6},{"file":"references/local-env-setup.md","line_end":7,"line_start":7},{"file":"references/local-env-setup.md","line_end":7,"line_start":7},{"file":"references/local-env-setup.md","line_end":14,"line_start":14},{"file":"references/local-env-setup.md","line_end":15,"line_start":15},{"file":"references/local-env-setup.md","line_end":24,"line_start":16},{"file":"references/local-env-setup.md","line_end":26,"line_start":24},{"file":"references/local-env-setup.md","line_end":29,"line_start":26},{"file":"references/local-env-setup.md","line_end":33,"line_start":29},{"file":"references/local-env-setup.md","line_end":35,"line_start":33},{"file":"references/local-env-setup.md","line_end":37,"line_start":35},{"file":"references/local-env-setup.md","line_end":45,"line_start":37},{"file":"references/local-env-setup.md","line_end":50,"line_start":45},{"file":"references/local-env-setup.md","line_end":51,"line_start":50},{"file":"references/refresh-antigravity.md","line_end":5,"line_start":5},{"file":"references/refresh-antigravity.md","line_end":5,"line_start":5},{"file":"references/refresh-antigravity.md","line_end":10,"line_start":8},{"file":"references/refresh-antigravity.md","line_end":13,"line_start":10},{"file":"references/refresh-antigravity.md","line_end":19,"line_start":13},{"file":"references/refresh-antigravity.md","line_end":20,"line_start":19},{"file":"references/refresh-antigravity.md","line_end":25,"line_start":20},{"file":"references/refresh-antigravity.md","line_end":27,"line_start":25},{"file":"references/refresh-antigravity.md","line_end":30,"line_start":27},{"file":"references/refresh-antigravity.md","line_end":32,"line_start":30},{"file":"references/refresh-antigravity.md","line_end":35,"line_start":32},{"file":"references/refresh-antigravity.md","line_end":37,"line_start":35},{"file":"references/refresh-antigravity.md","line_end":40,"line_start":37},{"file":"references/refresh-antigravity.md","line_end":46,"line_start":40},{"file":"references/refresh-claude.md","line_end":5,"line_start":5},{"file":"references/refresh-claude.md","line_end":10,"line_start":8},{"file":"references/refresh-gemini-cli.md","line_end":5,"line_start":5},{"file":"references/refresh-gemini-cli.md","line_end":10,"line_start":8},{"file":"references/refresh-gemini-cli.md","line_end":11,"line_start":10},{"file":"references/refresh-gemini-cli.md","line_end":11,"line_start":11},{"file":"references/refresh-other-agents.md","line_end":5,"line_start":5},{"file":"references/refresh-other-agents.md","line_end":5,"line_start":5},{"file":"references/refresh-other-agents.md","line_end":7,"line_start":7},{"file":"references/refresh-other-agents.md","line_end":12,"line_start":10},{"file":"references/refresh-other-agents.md","line_end":15,"line_start":12},{"file":"references/refresh-other-agents.md","line_end":21,"line_start":15},{"file":"references/refresh-other-agents.md","line_end":22,"line_start":21},{"file":"references/refresh-other-agents.md","line_end":27,"line_start":22},{"file":"references/refresh-other-agents.md","line_end":29,"line_start":27},{"file":"references/refresh-other-agents.md","line_end":32,"line_start":29},{"file":"references/refresh-other-agents.md","line_end":34,"line_start":32},{"file":"references/refresh-other-agents.md","line_end":37,"line_start":34},{"file":"references/refresh-other-agents.md","line_end":39,"line_start":37},{"file":"references/refresh-other-agents.md","line_end":42,"line_start":39},{"file":"references/refresh-other-agents.md","line_end":48,"line_start":42},{"file":"references/setup-antigravity.md","line_end":8,"line_start":8},{"file":"references/setup-antigravity.md","line_end":8,"line_start":8},{"file":"references/setup-antigravity.md","line_end":12,"line_start":10},{"file":"references/setup-antigravity.md","line_end":13,"line_start":12},{"file":"references/setup-antigravity.md","line_end":15,"line_start":13},{"file":"references/setup-antigravity.md","line_end":17,"line_start":15},{"file":"references/setup-antigravity.md","line_end":18,"line_start":17},{"file":"references/setup-antigravity.md","line_end":18,"line_start":18},{"file":"references/setup-antigravity.md","line_end":19,"line_start":18},{"file":"references/setup-antigravity.md","line_end":24,"line_start":19},{"file":"references/setup-antigravity.md","line_end":25,"line_start":24},{"file":"references/setup-antigravity.md","line_end":26,"line_start":25},{"file":"references/setup-antigravity.md","line_end":28,"line_start":26},{"file":"references/setup-antigravity.md","line_end":28,"line_start":28},{"file":"references/setup-antigravity.md","line_end":28,"line_start":28},{"file":"references/setup-antigravity.md","line_end":29,"line_start":28},{"file":"references/setup-antigravity.md","line_end":29,"line_start":29},{"file":"references/setup-antigravity.md","line_end":29,"line_start":29},{"file":"references/setup-antigravity.md","line_end":30,"line_start":29},{"file":"references/setup-antigravity.md","line_end":30,"line_start":30},{"file":"references/setup-antigravity.md","line_end":30,"line_start":30},{"file":"references/setup-antigravity.md","line_end":30,"line_start":30},{"file":"references/setup-antigravity.md","line_end":30,"line_start":30},{"file":"references/setup-antigravity.md","line_end":30,"line_start":30},{"file":"references/setup-antigravity.md","line_end":30,"line_start":30},{"file":"references/setup-antigravity.md","line_end":31,"line_start":30},{"file":"references/setup-antigravity.md","line_end":34,"line_start":31},{"file":"references/setup-antigravity.md","line_end":39,"line_start":34},{"file":"references/setup-antigravity.md","line_end":41,"line_start":39},{"file":"references/setup-antigravity.md","line_end":46,"line_start":41},{"file":"references/setup-antigravity.md","line_end":47,"line_start":46},{"file":"references/setup-antigravity.md","line_end":47,"line_start":47},{"file":"references/setup-antigravity.md","line_end":48,"line_start":47},{"file":"references/setup-antigravity.md","line_end":57,"line_start":48},{"file":"references/setup-antigravity.md","line_end":58,"line_start":57},{"file":"references/setup-antigravity.md","line_end":58,"line_start":58},{"file":"references/setup-antigravity.md","line_end":59,"line_start":58},{"file":"references/setup-claude_code.md","line_end":13,"line_start":13},{"file":"references/setup-claude_code.md","line_end":13,"line_start":13},{"file":"references/setup-claude_code.md","line_end":13,"line_start":13},{"file":"references/setup-claude_code.md","line_end":14,"line_start":14},{"file":"references/setup-claude_code.md","line_end":14,"line_start":14},{"file":"references/setup-claude_code.md","line_end":14,"line_start":14},{"file":"references/setup-claude_code.md","line_end":22,"line_start":20},{"file":"references/setup-claude_code.md","line_end":24,"line_start":22},{"file":"references/setup-claude_code.md","line_end":26,"line_start":24},{"file":"references/setup-cursor.md","line_end":8,"line_start":8},{"file":"references/setup-cursor.md","line_end":8,"line_start":8},{"file":"references/setup-cursor.md","line_end":12,"line_start":10},{"file":"references/setup-cursor.md","line_end":13,"line_start":12},{"file":"references/setup-cursor.md","line_end":15,"line_start":13},{"file":"references/setup-cursor.md","line_end":17,"line_start":15},{"file":"references/setup-cursor.md","line_end":18,"line_start":17},{"file":"references/setup-cursor.md","line_end":18,"line_start":18},{"file":"references/setup-cursor.md","line_end":19,"line_start":18},{"file":"references/setup-cursor.md","line_end":24,"line_start":19},{"file":"references/setup-cursor.md","line_end":25,"line_start":24},{"file":"references/setup-cursor.md","line_end":26,"line_start":25},{"file":"references/setup-cursor.md","line_end":28,"line_start":26},{"file":"references/setup-cursor.md","line_end":28,"line_start":28},{"file":"references/setup-cursor.md","line_end":29,"line_start":28},{"file":"references/setup-cursor.md","line_end":29,"line_start":29},{"file":"references/setup-cursor.md","line_end":29,"line_start":29},{"file":"references/setup-cursor.md","line_end":30,"line_start":29},{"file":"references/setup-cursor.md","line_end":30,"line_start":30},{"file":"references/setup-cursor.md","line_end":30,"line_start":30},{"file":"references/setup-cursor.md","line_end":30,"line_start":30},{"file":"references/setup-cursor.md","line_end":30,"line_start":30},{"file":"references/setup-cursor.md","line_end":30,"line_start":30},{"file":"references/setup-cursor.md","line_end":30,"line_start":30},{"file":"references/setup-cursor.md","line_end":31,"line_start":30},{"file":"references/setup-cursor.md","line_end":34,"line_start":31},{"file":"references/setup-cursor.md","line_end":39,"line_start":34},{"file":"references/setup-cursor.md","line_end":41,"line_start":39},{"file":"references/setup-cursor.md","line_end":46,"line_start":41},{"file":"references/setup-cursor.md","line_end":47,"line_start":46},{"file":"references/setup-cursor.md","line_end":47,"line_start":47},{"file":"references/setup-cursor.md","line_end":48,"line_start":47},{"file":"references/setup-cursor.md","line_end":57,"line_start":48},{"file":"references/setup-cursor.md","line_end":58,"line_start":57},{"file":"references/setup-cursor.md","line_end":58,"line_start":58},{"file":"references/setup-cursor.md","line_end":59,"line_start":58},{"file":"references/setup-gemini_cli.md","line_end":12,"line_start":12},{"file":"references/setup-gemini_cli.md","line_end":12,"line_start":12},{"file":"references/setup-gemini_cli.md","line_end":16,"line_start":14},{"file":"references/setup-gemini_cli.md","line_end":18,"line_start":16},{"file":"references/setup-gemini_cli.md","line_end":18,"line_start":18},{"file":"references/setup-gemini_cli.md","line_end":19,"line_start":18},{"file":"references/setup-gemini_cli.md","line_end":19,"line_start":19},{"file":"references/setup-gemini_cli.md","line_end":31,"line_start":19},{"file":"references/setup-gemini_cli.md","line_end":31,"line_start":31},{"file":"references/setup-gemini_cli.md","line_end":33,"line_start":31},{"file":"references/setup-gemini_cli.md","line_end":35,"line_start":33},{"file":"references/setup-gemini_cli.md","line_end":36,"line_start":35},{"file":"references/setup-gemini_cli.md","line_end":36,"line_start":36},{"file":"references/setup-github_copilot.md","line_end":12,"line_start":12},{"file":"references/setup-github_copilot.md","line_end":12,"line_start":12},{"file":"references/setup-github_copilot.md","line_end":16,"line_start":14},{"file":"references/setup-github_copilot.md","line_end":17,"line_start":16},{"file":"references/setup-github_copilot.md","line_end":19,"line_start":17},{"file":"references/setup-github_copilot.md","line_end":21,"line_start":19},{"file":"references/setup-github_copilot.md","line_end":22,"line_start":21},{"file":"references/setup-github_copilot.md","line_end":22,"line_start":22},{"file":"references/setup-github_copilot.md","line_end":23,"line_start":22},{"file":"references/setup-github_copilot.md","line_end":28,"line_start":23},{"file":"references/setup-github_copilot.md","line_end":29,"line_start":28},{"file":"references/setup-github_copilot.md","line_end":30,"line_start":29},{"file":"references/setup-github_copilot.md","line_end":32,"line_start":30},{"file":"references/setup-github_copilot.md","line_end":32,"line_start":32},{"file":"references/setup-github_copilot.md","line_end":32,"line_start":32},{"file":"references/setup-github_copilot.md","line_end":33,"line_start":32},{"file":"references/setup-github_copilot.md","line_end":33,"line_start":33},{"file":"references/setup-github_copilot.md","line_end":33,"line_start":33},{"file":"references/setup-github_copilot.md","line_end":34,"line_start":33},{"file":"references/setup-github_copilot.md","line_end":34,"line_start":34},{"file":"references/setup-github_copilot.md","line_end":34,"line_start":34},{"file":"references/setup-github_copilot.md","line_end":34,"line_start":34},{"file":"references/setup-github_copilot.md","line_end":34,"line_start":34},{"file":"references/setup-github_copilot.md","line_end":34,"line_start":34},{"file":"references/setup-github_copilot.md","line_end":34,"line_start":34},{"file":"references/setup-github_copilot.md","line_end":35,"line_start":34},{"file":"references/setup-github_copilot.md","line_end":38,"line_start":35},{"file":"references/setup-github_copilot.md","line_end":44,"line_start":38},{"file":"references/setup-github_copilot.md","line_end":46,"line_start":44},{"file":"references/setup-github_copilot.md","line_end":52,"line_start":46},{"file":"references/setup-github_copilot.md","line_end":53,"line_start":52},{"file":"references/setup-github_copilot.md","line_end":53,"line_start":53},{"file":"references/setup-github_copilot.md","line_end":54,"line_start":53},{"file":"references/setup-github_copilot.md","line_end":64,"line_start":54},{"file":"references/setup-github_copilot.md","line_end":65,"line_start":64},{"file":"references/setup-github_copilot.md","line_end":65,"line_start":65},{"file":"references/setup-github_copilot.md","line_end":65,"line_start":65},{"file":"references/setup-github_copilot.md","line_end":66,"line_start":65},{"file":"references/setup-other_agents.md","line_end":12,"line_start":12},{"file":"references/setup-other_agents.md","line_end":12,"line_start":12},{"file":"references/setup-other_agents.md","line_end":12,"line_start":12},{"file":"references/setup-other_agents.md","line_end":16,"line_start":14},{"file":"references/setup-other_agents.md","line_end":17,"line_start":16},{"file":"references/setup-other_agents.md","line_end":19,"line_start":17},{"file":"references/setup-other_agents.md","line_end":21,"line_start":19},{"file":"references/setup-other_agents.md","line_end":22,"line_start":21},{"file":"references/setup-other_agents.md","line_end":22,"line_start":22},{"file":"references/setup-other_agents.md","line_end":23,"line_start":22},{"file":"references/setup-other_agents.md","line_end":28,"line_start":23},{"file":"references/setup-other_agents.md","line_end":28,"line_start":28},{"file":"references/setup-other_agents.md","line_end":28,"line_start":28},{"file":"references/setup-other_agents.md","line_end":30,"line_start":28},{"file":"references/setup-other_agents.md","line_end":31,"line_start":30},{"file":"references/setup-other_agents.md","line_end":31,"line_start":31},{"file":"references/setup-other_agents.md","line_end":32,"line_start":31},{"file":"references/setup-other_agents.md","line_end":32,"line_start":32},{"file":"references/setup-other_agents.md","line_end":32,"line_start":32},{"file":"references/setup-other_agents.md","line_end":32,"line_start":32},{"file":"references/setup-other_agents.md","line_end":32,"line_start":32},{"file":"references/setup-other_agents.md","line_end":32,"line_start":32},{"file":"references/setup-other_agents.md","line_end":32,"line_start":32},{"file":"references/setup-other_agents.md","line_end":33,"line_start":32},{"file":"references/setup-other_agents.md","line_end":36,"line_start":33},{"file":"references/setup-other_agents.md","line_end":41,"line_start":36},{"file":"references/setup-other_agents.md","line_end":43,"line_start":41},{"file":"references/setup-other_agents.md","line_end":48,"line_start":43},{"file":"references/setup-other_agents.md","line_end":49,"line_start":48},{"file":"references/setup-other_agents.md","line_end":49,"line_start":49},{"file":"references/setup-other_agents.md","line_end":50,"line_start":49},{"file":"references/setup-other_agents.md","line_end":59,"line_start":50},{"file":"references/setup-other_agents.md","line_end":60,"line_start":59},{"file":"references/setup-other_agents.md","line_end":61,"line_start":60},{"file":"references/web_setup.md","line_end":8,"line_start":6},{"file":"references/web_setup.md","line_end":11,"line_start":8},{"file":"references/web_setup.md","line_end":13,"line_start":11},{"file":"references/web_setup.md","line_end":19,"line_start":13},{"file":"references/web_setup.md","line_end":21,"line_start":19},{"file":"references/web_setup.md","line_end":24,"line_start":21},{"file":"references/web_setup.md","line_end":24,"line_start":24},{"file":"references/web_setup.md","line_end":26,"line_start":24},{"file":"references/web_setup.md","line_end":28,"line_start":26},{"file":"references/web_setup.md","line_end":32,"line_start":28},{"file":"references/web_setup.md","line_end":52,"line_start":32},{"file":"references/web_setup.md","line_end":57,"line_start":52},{"file":"references/web_setup.md","line_end":66,"line_start":57},{"file":"references/web_setup.md","line_end":69,"line_start":66},{"file":"SKILL.md","line_end":10,"line_start":10},{"file":"SKILL.md","line_end":15,"line_start":15},{"file":"SKILL.md","line_end":15,"line_start":15},{"file":"SKILL.md","line_end":20,"line_start":20},{"file":"SKILL.md","line_end":21,"line_start":21},{"file":"SKILL.md","line_end":26,"line_start":24},{"file":"SKILL.md","line_end":33,"line_start":26},{"file":"SKILL.md","line_end":33,"line_start":33},{"file":"SKILL.md","line_end":33,"line_start":33},{"file":"SKILL.md","line_end":33,"line_start":33},{"file":"SKILL.md","line_end":34,"line_start":33},{"file":"SKILL.md","line_end":52,"line_start":34}]},{"factor":"network","evidence":[{"file":"references/local-env-setup.md","line_end":13,"line_start":13},{"file":"references/local-env-setup.md","line_end":32,"line_start":32},{"file":"references/local-env-setup.md","line_end":40,"line_start":40},{"file":"references/refresh-other-agents.md","line_end":7,"line_start":7},{"file":"references/setup-gemini_cli.md","line_end":15,"line_start":15},{"file":"references/setup-other_agents.md","line_end":12,"line_start":12}]},{"factor":"filesystem","evidence":[{"file":"references/local-env-setup.md","line_end":18,"line_start":18},{"file":"references/local-env-setup.md","line_end":19,"line_start":19},{"file":"references/local-env-setup.md","line_end":22,"line_start":22},{"file":"references/local-env-setup.md","line_end":23,"line_start":23},{"file":"references/local-env-setup.md","line_end":18,"line_start":18},{"file":"references/local-env-setup.md","line_end":19,"line_start":19},{"file":"references/local-env-setup.md","line_end":22,"line_start":22},{"file":"references/local-env-setup.md","line_end":23,"line_start":23},{"file":"references/setup-antigravity.md","line_end":25,"line_start":25},{"file":"references/setup-antigravity.md","line_end":25,"line_start":25},{"file":"references/setup-cursor.md","line_end":25,"line_start":25},{"file":"references/setup-cursor.md","line_end":25,"line_start":25},{"file":"references/setup-other_agents.md","line_end":28,"line_start":28},{"file":"references/setup-other_agents.md","line_end":28,"line_start":28}]},{"factor":"env_access","evidence":[{"file":"references/web_setup.md","line_end":38,"line_start":38}]}],"critical_findings":[],"high_findings":[{"title":"Prompt Injection Style Agent Control","verdict":"TRUE_POSITIVE","category":"prompt_injection","severity":"high","locations":[{"file":"SKILL.md","line_end":3,"line_start":3},{"file":"references/local-env-setup.md","line_end":65,"line_start":65}],"confidence":0.82,"description":"The skill uses broad agent-control language that tells agents to always use the skill for Firebase and not proceed with Firebase tasks until setup is complete. This does not show confirmed malicious intent, but it can override normal task prioritization and requires marketplace review.","recommendation":"Rewrite these instructions as scoped guidance for Firebase setup, and remove language that claims mandatory agent authority.","confidence_reasoning":"The cited lines contain explicit always-use and do-not-proceed agent directives. They do not target the evaluator or security review, so confidence is high but not critical."}],"medium_findings":[{"title":"Remote Package Execution Through CLI Guidance","verdict":"TRUE_POSITIVE","category":"external_commands","severity":"medium","locations":[{"file":"SKILL.md","line_end":15,"line_start":10},{"file":"references/local-env-setup.md","line_end":51,"line_start":45},{"file":"references/refresh-other-agents.md","line_end":48,"line_start":41}],"confidence":0.9,"description":"The skill repeatedly instructs agents to run npx commands that fetch the latest Firebase tools or skills packages. This is expected for Firebase setup, but it creates supply-chain and unattended execution risk.","recommendation":"Require user confirmation before running package manager commands and prefer pinned versions where practical.","confidence_reasoning":"The commands are explicit and semantically intended to execute remote package tooling. The behavior is legitimate for the skill, but it remains a real operational risk."},{"title":"Local Agent Configuration File Modification","verdict":"TRUE_POSITIVE","category":"filesystem","severity":"medium","locations":[{"file":"references/setup-cursor.md","line_end":28,"line_start":24},{"file":"references/setup-antigravity.md","line_end":28,"line_start":24},{"file":"references/setup-other_agents.md","line_end":30,"line_start":28}],"confidence":0.86,"description":"The setup guides instruct agents to locate, create, and merge MCP server configuration into local or home-directory agent settings. This is legitimate setup behavior, but incorrect edits could alter trusted tool configuration.","recommendation":"Require an explicit user approval step before editing agent configuration, and preserve existing MCP server entries.","confidence_reasoning":"The files clearly direct agents to modify MCP configuration files, including hidden home-directory paths. The instructions also say to preserve existing servers, reducing but not eliminating risk."}],"low_findings":[{"title":"Hardcoded Documentation URLs","verdict":"FALSE_POSITIVE","category":"network","severity":"low","locations":[{"file":"references/local-env-setup.md","line_end":13,"line_start":13},{"file":"references/setup-gemini_cli.md","line_end":15,"line_start":15},{"file":"references/refresh-other-agents.md","line_end":7,"line_start":7}],"confidence":0.88,"description":"The network findings are links to official or relevant setup documentation and repository locations. They do not show hidden callbacks or exfiltration endpoints.","recommendation":"Keep external links visible and user-facing, and avoid adding hidden network requests.","confidence_reasoning":"The URLs are plainly shown in Markdown setup instructions. No evidence found that these links transmit local data or credentials."},{"title":"Firebase Web API Key Placeholder","verdict":"FALSE_POSITIVE","category":"env_access","severity":"low","locations":[{"file":"references/web_setup.md","line_end":45,"line_start":36}],"confidence":0.84,"description":"The env_access finding points to an example Firebase web configuration placeholder. Firebase web API keys identify a project but are not service account secrets by themselves.","recommendation":"Clarify that users should not place service account keys or private credentials in client-side Firebase configuration.","confidence_reasoning":"The value is a placeholder inside a standard Firebase client initialization example. No evidence found of real credentials or exfiltration."},{"title":"Static Weak-Crypto Detections Are Text Matches","verdict":"FALSE_POSITIVE","category":"blocker","severity":"low","locations":[{"file":"SKILL.md","line_end":3,"line_start":3},{"file":"references/setup-claude_code.md","line_end":14,"line_start":13},{"file":"references/setup-gemini_cli.md","line_end":12,"line_start":12}],"confidence":0.8,"description":"The weak cryptographic algorithm findings appear to be false positives triggered by ordinary words and command text in setup documentation. No evidence found of implemented cryptographic code.","recommendation":"No cryptography remediation is needed unless future versions add actual hashing or encryption logic.","confidence_reasoning":"The cited content is Markdown setup guidance, not executable crypto implementation. The static pattern likely matched substrings such as skill names or command arguments."}],"dangerous_patterns":[{"title":"Latest-Version Package Execution Pattern","verdict":"TRUE_POSITIVE","category":"external_commands","severity":"medium","locations":[{"file":"SKILL.md","line_end":33,"line_start":33},{"file":"references/firebase-cli-guide.md","line_end":15,"line_start":6}],"confidence":0.91,"description":"The skill normalizes commands that execute the latest Firebase CLI through npx. This can run newly published package code without version pinning.","recommendation":"Prefer pinned versions for repeatable automation, or ask the user before using latest packages.","confidence_reasoning":"The package execution pattern is directly documented and repeated. The risk is supply-chain exposure, not proven malicious behavior."}],"files_scanned":16,"total_lines":691,"audit_model":"codex","audited_at":"2026-06-30T00:43:13.709+00:00","created_at":"2026-06-30T01:34:35.943472+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"high","confirmedFindingCount":3,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":3,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}