{"data":{"skill":{"slug":"firebase-firebase-firestore","name":"firebase-firestore","icon":"📦","repo":"https://github.com/firebase/agent-skills/tree/main/skills/firebase-firestore/","status":"approved","author":"firebase","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"5c952ad9-7ad4-4ea3-9089-af4d01b8ccf2","skill_id":"98da0f51-0f79-4c4b-b180-42559a9d7cd8","version":2,"content_hash":"caa6a273fa9a8d8d110e6c98a3195b83","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"Static analysis found many command, network, and credential patterns. Manual review shows most are markdown examples for Firebase SDKs, Firestore rules, and security testing, but the skill does instruct agents to run Firebase CLI commands through npx and deploy or create Firestore resources. No prompt injection or confirmed malicious exfiltration was found; publish with a warning about external commands and cloud mutations.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":20,"line_start":19},{"file":"SKILL.md","line_end":42,"line_start":41},{"file":"references/standard/provisioning.md","line_end":90,"line_start":81},{"file":"references/enterprise/provisioning.md","line_end":113,"line_start":97}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":9,"line_start":9},{"file":"SKILL.md","line_end":20,"line_start":19},{"file":"references/standard/provisioning.md","line_end":32,"line_start":29},{"file":"references/enterprise/provisioning.md","line_end":24,"line_start":18}]},{"factor":"filesystem","evidence":[{"file":"references/standard/provisioning.md","line_end":23,"line_start":15},{"file":"references/standard/provisioning.md","line_end":75,"line_start":47},{"file":"references/enterprise/provisioning.md","line_end":60,"line_start":48},{"file":"references/enterprise/provisioning.md","line_end":90,"line_start":63}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"External Firebase CLI Execution","locations":[{"file":"SKILL.md","line_end":9,"line_start":9},{"file":"SKILL.md","line_end":20,"line_start":19},{"file":"references/standard/provisioning.md","line_end":90,"line_start":81}],"confidence":0.9,"description":"The skill tells agents to run Firebase CLI commands with npx and firebase-tools@latest. This is legitimate Firestore management, but it can download executable code, use credentials, and act on a Firebase project.","confidence_reasoning":"The command strings are explicit and are part of the intended workflow. The risk is operational rather than malicious because the commands target Firebase administration."},{"title":"Cloud Resource Mutation Commands","locations":[{"file":"SKILL.md","line_end":42,"line_start":41},{"file":"references/enterprise/provisioning.md","line_end":30,"line_start":24},{"file":"references/standard/provisioning.md","line_end":90,"line_start":81}],"confidence":0.88,"description":"The skill includes commands that create Firestore databases and deploy rules or indexes. These operations can change live cloud resources if run against a real project.","confidence_reasoning":"The cited lines directly show create and deploy workflows. They are expected for the skill, but they require explicit user approval and project verification."},{"title":"Local Firebase Configuration Writes","locations":[{"file":"references/standard/provisioning.md","line_end":23,"line_start":15},{"file":"references/standard/provisioning.md","line_end":75,"line_start":47},{"file":"references/enterprise/provisioning.md","line_end":60,"line_start":48}],"confidence":0.82,"description":"The provisioning guides direct agents to create or update firebase.json, firestore.rules, and firestore.indexes.json. Incorrect edits could weaken rules or disrupt deployment configuration.","confidence_reasoning":"The file-write instructions are explicit. This is a normal setup capability, but mistakes can affect application security and deployment behavior."}],"low_findings":[{"title":"Dismissed Shell Command Substitution Matches","locations":[{"file":"references/standard/security_rules.md","line_end":435,"line_start":420},{"file":"references/enterprise/security_rules.md","line_end":435,"line_start":420}],"confidence":0.93,"description":"The scanner flagged $() syntax in Firestore Rules path interpolation. The reviewed lines are fenced documentation examples, not host shell execution.","confidence_reasoning":"The syntax appears inside Firestore Rules examples that use /databases/$(database)/documents paths. This is not shell command substitution."},{"title":"Dismissed Credential Keyword Matches","locations":[{"file":"references/standard/security_rules.md","line_end":518,"line_start":515},{"file":"references/enterprise/security_rules.md","line_end":518,"line_start":515}],"confidence":0.9,"description":"The scanner flagged private-key wording in a defensive checklist. The text asks users to test for data exposure and does not include secrets or exfiltration logic.","confidence_reasoning":"The context is an attack checklist for hardening Firestore rules. No actual key, certificate, seed phrase, or outbound transfer is present."},{"title":"Dismissed Weak Crypto Matches","locations":[{"file":"references/standard/indexes.md","line_end":60,"line_start":46},{"file":"references/enterprise/indexes.md","line_end":23,"line_start":22},{"file":"references/standard/flutter_setup.md","line_end":89,"line_start":82}],"confidence":0.86,"description":"The weak-cryptography alerts map to Firestore query and index examples, not cryptographic algorithms. No reviewed file implements hashing, encryption, or key derivation.","confidence_reasoning":"The cited content is about Firestore query operators, field ordering, and SDK calls. The static labels do not match the semantic context."}],"dangerous_patterns":[{"title":"Unpinned Latest CLI Package","locations":[{"file":"SKILL.md","line_end":9,"line_start":9},{"file":"SKILL.md","line_end":20,"line_start":19}],"confidence":0.91,"description":"The skill recommends firebase-tools@latest through npx. Using latest can change behavior between runs and downloads executable tooling at execution time.","confidence_reasoning":"The @latest package reference is explicit. This is common CLI usage, but it increases supply-chain and reproducibility risk."},{"title":"Firestore Deploy Commands","locations":[{"file":"references/standard/provisioning.md","line_end":90,"line_start":81},{"file":"references/enterprise/provisioning.md","line_end":105,"line_start":97}],"confidence":0.89,"description":"The guides include deploy commands for Firestore rules and indexes. These commands can alter cloud authorization behavior for a project.","confidence_reasoning":"The deploy commands are explicit and security-sensitive. They are legitimate only when the user has selected the intended project and reviewed generated rules."},{"title":"Firestore Database Creation Commands","locations":[{"file":"SKILL.md","line_end":42,"line_start":41},{"file":"references/enterprise/provisioning.md","line_end":30,"line_start":24}],"confidence":0.88,"description":"The skill can guide creation of new Firestore databases. This may create billable or persistent cloud resources in the selected Firebase project.","confidence_reasoning":"The create commands are concrete and target cloud resources. The behavior is expected for this skill but should be gated by user confirmation."}],"files_scanned":17,"total_lines":3190,"audit_model":"codex","audited_at":"2026-06-30T00:53:11.427+00:00","created_at":"2026-06-30T01:34:37.055129+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"low","confirmedFindingCount":2,"capabilityReviewCount":3,"needsReviewCount":0,"falsePositiveCount":1,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}