{"data":{"skill":{"slug":"firebase-firebase-firestore","name":"firebase-firestore","icon":"📦","repo":"https://github.com/firebase/agent-skills/tree/main/skills/firebase-firestore/","status":"approved","author":"firebase","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"e26e9c8f-25b6-4007-b06f-86fccdb52957","skill_id":"98da0f51-0f79-4c4b-b180-42559a9d7cd8","version":4,"content_hash":"7c3396ae0b13cdc6c176047c0aa1c4be","risk_level":"low","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"Most static findings are false positives from Firestore documentation, Markdown formatting, and Security Rules syntax. Confirmed issues are limited to Firebase CLI guidance that can execute external npm tooling or modify cloud resources. No evidence found of credential exfiltration, malware behavior, or prompt injection intended to bypass audit controls.","remediation":[{"issue":"Firebase CLI commands execute external tooling and can change cloud resources.","severity":"medium","suggestion":"Require explicit user confirmation before running Firebase CLI commands, especially database creation commands."},{"issue":"The skill recommends npx with firebase-tools@latest.","severity":"medium","suggestion":"Prefer a pinned Firebase CLI version or ask the user to confirm the version before execution."},{"issue":"Provisioning examples may be copied into production contexts.","severity":"low","suggestion":"Add reminders to verify the active Firebase project, database ID, and location before running commands."}],"risk_factor_evidence":[{"factor":"network","evidence":[{"file":"references/enterprise/android_sdk_usage.md","line_end":21,"line_start":21},{"file":"references/enterprise/security_rules.md","line_end":141,"line_start":141},{"file":"references/standard/android_sdk_usage.md","line_end":21,"line_start":21},{"file":"references/standard/security_rules.md","line_end":141,"line_start":141}]},{"factor":"external_commands","evidence":[{"file":"references/enterprise/security_rules.md","line_end":430,"line_start":430},{"file":"references/enterprise/security_rules.md","line_end":431,"line_start":431},{"file":"references/enterprise/security_rules.md","line_end":434,"line_start":434},{"file":"references/enterprise/security_rules.md","line_end":435,"line_start":435},{"file":"references/standard/security_rules.md","line_end":430,"line_start":430},{"file":"references/standard/security_rules.md","line_end":431,"line_start":431},{"file":"references/standard/security_rules.md","line_end":434,"line_start":434},{"file":"references/standard/security_rules.md","line_end":435,"line_start":435},{"file":"SKILL.md","line_end":9,"line_start":9},{"file":"SKILL.md","line_end":20,"line_start":19},{"file":"SKILL.md","line_end":25,"line_start":24},{"file":"SKILL.md","line_end":29,"line_start":29},{"file":"SKILL.md","line_end":30,"line_start":30},{"file":"SKILL.md","line_end":31,"line_start":31},{"file":"SKILL.md","line_end":32,"line_start":32},{"file":"SKILL.md","line_end":38,"line_start":38},{"file":"SKILL.md","line_end":42,"line_start":42},{"file":"SKILL.md","line_end":44,"line_start":44},{"file":"SKILL.md","line_end":53,"line_start":53},{"file":"SKILL.md","line_end":60,"line_start":60}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":9,"line_start":9}],"confidence":0.76,"description":"compatibility: This skill is best used with the Firebase CLI, but does not require it. Firebase CLI ","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The compatibility note recommends accessing Firebase CLI through npx with the latest package. That can download and execute external npm code, so it is a real supply-chain and command execution concern."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":20,"line_start":19}],"confidence":0.86,"description":"Run the following command to list current Firestore databases: `bash npx -y","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"This instruction runs Firebase CLI through npx with the latest firebase-tools package. The command is for legitimate Firestore administration, but it executes external tooling from npm."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":25,"line_start":24}],"confidence":0.86,"description":"1.  For each database found, inspect its edition and details: `bash npx -y","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"This instruction runs Firebase CLI through npx with the latest firebase-tools package. The command is for legitimate Firestore administration, but it executes external tooling from npm."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":38,"line_start":38}],"confidence":0.86,"description":"Run `npx -y firebase-tools@latest firestore:locations` to get the list of options.","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"This instruction runs Firebase CLI through npx with the latest firebase-tools package. The command is for legitimate Firestore administration, but it executes external tooling from npm."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":42,"line_start":42}],"confidence":0.9,"description":"`bash npx -y firebase-tools@latest firestore:databases:create <database-id> --edition=\"enterprise\" -","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"This line directs use of Firebase CLI to create a Firestore database, which can change cloud resources. It is legitimate tooling, but it requires explicit user confirmation and project context."}],"low_findings":[{"title":"System reconnaissance","locations":[{"file":"references/enterprise/provisioning.md","line_end":25,"line_start":25}],"confidence":0.68,"description":"firebase firestore:databases:create my-database-id \\","review_kind":"security","source_category":"blocker","source_severity":"low","confidence_reasoning":"The line is a Firebase CLI database creation example that can modify cloud resources if copied and run. It is not system reconnaissance, but the operational impact warrants keeping it as a low-risk finding."},{"title":"System reconnaissance","locations":[{"file":"references/enterprise/provisioning.md","line_end":38,"line_start":38}],"confidence":0.68,"description":"firebase firestore:databases:create my-database-id \\","review_kind":"security","source_category":"blocker","source_severity":"low","confidence_reasoning":"The line is a Firebase CLI database creation example that can modify cloud resources if copied and run. It is not system reconnaissance, but the operational impact warrants keeping it as a low-risk finding."}],"dangerous_patterns":[{"title":"System reconnaissance","locations":[{"file":"references/enterprise/provisioning.md","line_end":25,"line_start":25}],"confidence":0.68,"description":"firebase firestore:databases:create my-database-id \\","review_kind":"security","source_category":"blocker","source_severity":"low","confidence_reasoning":"The line is a Firebase CLI database creation example that can modify cloud resources if copied and run. It is not system reconnaissance, but the operational impact warrants keeping it as a low-risk finding."},{"title":"System reconnaissance","locations":[{"file":"references/enterprise/provisioning.md","line_end":38,"line_start":38}],"confidence":0.68,"description":"firebase firestore:databases:create my-database-id \\","review_kind":"security","source_category":"blocker","source_severity":"low","confidence_reasoning":"The line is a Firebase CLI database creation example that can modify cloud resources if copied and run. It is not system reconnaissance, but the operational impact warrants keeping it as a low-risk finding."}],"files_scanned":17,"total_lines":3190,"audit_model":"codex","audited_at":"2026-07-05T14:43:51.848+00:00","created_at":"2026-07-07T02:32:26.739524+00:00","static_findings":[{"id":"network:references/enterprise/android_sdk_usage.md:21:hardcoded-url","file":"references/enterprise/android_sdk_usage.md","pattern":"Hardcoded URL","snippet":"// [AGENT] Fetch the latest available BoM version from https://firebase.google.com/support/release-n","category":"network","line_end":21,"severity":"low","line_start":21},{"id":"blocker:references/enterprise/android_sdk_usage.md:1:system-reconnaissance","file":"references/enterprise/android_sdk_usage.md","pattern":"System reconnaissance","snippet":"# Firestore Enterprise Native Mode on Android (Kotlin)","category":"blocker","line_end":1,"severity":"low","line_start":1},{"id":"blocker:references/enterprise/android_sdk_usage.md:3:system-reconnaissance","file":"references/enterprise/android_sdk_usage.md","pattern":"System reconnaissance","snippet":"This guide walks you through using the Cloud Firestore SDK in your Android app using Kotlin. The SDK","category":"blocker","line_end":3,"severity":"low","line_start":3},{"id":"blocker:references/enterprise/android_sdk_usage.md:21:system-reconnaissance","file":"references/enterprise/android_sdk_usage.md","pattern":"System reconnaissance","snippet":"// [AGENT] Fetch the latest available BoM version from https://firebase.google.com/support/release-n","category":"blocker","line_end":21,"severity":"low","line_start":21},{"id":"blocker:references/enterprise/indexes.md:6:system-reconnaissance","file":"references/enterprise/indexes.md","pattern":"System reconnaissance","snippet":"expensive for large collections. To avoid this, you can create indexes to","category":"blocker","line_end":6,"severity":"low","line_start":6},{"id":"blocker:references/enterprise/provisioning.md:25:system-reconnaissance","file":"references/enterprise/provisioning.md","pattern":"System reconnaissance","snippet":"firebase firestore:databases:create my-database-id \\","category":"blocker","line_end":25,"severity":"low","line_start":25},{"id":"blocker:references/enterprise/provisioning.md:33:system-reconnaissance","file":"references/enterprise/provisioning.md","pattern":"System reconnaissance","snippet":"database id is required to create an enterprise database and the database id","category":"blocker","line_end":33,"severity":"low","line_start":33},{"id":"blocker:references/enterprise/provisioning.md:38:system-reconnaissance","file":"references/enterprise/provisioning.md","pattern":"System reconnaissance","snippet":"firebase firestore:databases:create my-database-id \\","category":"blocker","line_end":38,"severity":"low","line_start":38},{"id":"external_commands:references/enterprise/security_rules.md:430:shell-command-substitution","file":"references/enterprise/security_rules.md","pattern":"Shell command substitution","snippet":"!exists(/databases/$(database)/documents/votes/$(request.auth.uid + '_' + docId)) &&","category":"external_commands","line_end":430,"severity":"medium","line_start":430},{"id":"external_commands:references/enterprise/security_rules.md:431:shell-command-substitution","file":"references/enterprise/security_rules.md","pattern":"Shell command substitution","snippet":"getAfter(/databases/$(database)/documents/votes/$(request.auth.uid + '_' + docId)) != null) ||","category":"external_commands","line_end":431,"severity":"medium","line_start":431},{"id":"external_commands:references/enterprise/security_rules.md:434:shell-command-substitution","file":"references/enterprise/security_rules.md","pattern":"Shell command substitution","snippet":"exists(/databases/$(database)/documents/votes/$(request.auth.uid + '_' + docId)) &&","category":"external_commands","line_end":434,"severity":"medium","line_start":434},{"id":"external_commands:references/enterprise/security_rules.md:435:shell-command-substitution","file":"references/enterprise/security_rules.md","pattern":"Shell command substitution","snippet":"getAfter(/databases/$(database)/documents/votes/$(request.auth.uid + '_' + docId)) == null)","category":"external_commands","line_end":435,"severity":"medium","line_start":435},{"id":"network:references/enterprise/security_rules.md:141:hardcoded-url","file":"references/enterprise/security_rules.md","pattern":"Hardcoded URL","snippet":"(url.matches(\"^https://.*\") || url.matches(\"^http://.*\"));","category":"network","line_end":141,"severity":"low","line_start":141},{"id":"sensitive:references/enterprise/security_rules.md:128:certificate-key-files","file":"references/enterprise/security_rules.md","pattern":"Certificate/key files","snippet":"return request.resource.data.keys().hasAll(fields);","category":"sensitive","line_end":128,"severity":"high","line_start":128},{"id":"sensitive:references/enterprise/security_rules.md:185:certificate-key-files","file":"references/enterprise/security_rules.md","pattern":"Certificate/key files","snippet":"return mapData is map && mapData.keys().hasOnly(allowedKeys);","category":"sensitive","line_end":185,"severity":"high","line_start":185},{"id":"sensitive:references/enterprise/security_rules.md:190:certificate-key-files","file":"references/enterprise/security_rules.md","pattern":"Certificate/key files","snippet":"return request.resource.data.keys().hasOnly(fields);","category":"sensitive","line_end":190,"severity":"high","line_start":190},{"id":"sensitive:references/enterprise/security_rules.md:517:crypto-seed-private-key-mention","file":"references/enterprise/security_rules.md","pattern":"Crypto seed/private key mention","snippet":"document also contain User A's email or private keys? If both are true, the","category":"sensitive","line_end":517,"severity":"high","line_start":517},{"id":"blocker:references/enterprise/security_rules.md:6:system-reconnaissance","file":"references/enterprise/security_rules.md","pattern":"System reconnaissance","snippet":"security incidents and avoid misleading the user about the security of their","category":"blocker","line_end":6,"severity":"low","line_start":6},{"id":"blocker:references/enterprise/security_rules.md:92:system-reconnaissance","file":"references/enterprise/security_rules.md","pattern":"System reconnaissance","snippet":"1.  **Include comprehensive helper functions to avoid repetition:**","category":"blocker","line_end":92,"severity":"low","line_start":92},{"id":"blocker:references/enterprise/security_rules.md:106:system-reconnaissance","file":"references/enterprise/security_rules.md","pattern":"System reconnaissance","snippet":"return isAuthenticated() && request.auth.uid == userId;","category":"blocker","line_end":106,"severity":"low","line_start":106},{"id":"blocker:references/enterprise/security_rules.md:109:system-reconnaissance","file":"references/enterprise/security_rules.md","pattern":"System reconnaissance","snippet":"// Check if user is owner based on document's uid field","category":"blocker","line_end":109,"severity":"low","line_start":109},{"id":"blocker:references/enterprise/security_rules.md:111:system-reconnaissance","file":"references/enterprise/security_rules.md","pattern":"System reconnaissance","snippet":"return isAuthenticated() && request.auth.uid == resource.data.uid;","category":"blocker","line_end":111,"severity":"low","line_start":111},{"id":"blocker:references/enterprise/security_rules.md:117:system-reconnaissance","file":"references/enterprise/security_rules.md","pattern":"System reconnaissance","snippet":"request.resource.data.uid == request.auth.uid;","category":"blocker","line_end":117,"severity":"low","line_start":117},{"id":"blocker:references/enterprise/security_rules.md:120:system-reconnaissance","file":"references/enterprise/security_rules.md","pattern":"System reconnaissance","snippet":"// Ensure uid field is not modified on update","category":"blocker","line_end":120,"severity":"low","line_start":120},{"id":"blocker:references/enterprise/security_rules.md:123:system-reconnaissance","file":"references/enterprise/security_rules.md","pattern":"System reconnaissance","snippet":"request.resource.data.uid == resource.data.uid;","category":"blocker","line_end":123,"severity":"low","line_start":123},{"id":"blocker:references/enterprise/security_rules.md:162:system-reconnaissance","file":"references/enterprise/security_rules.md","pattern":"System reconnaissance","snippet":"return path is string && path.matches(\"^users/\" + request.auth.uid + \"/.*\");","category":"blocker","line_end":162,"severity":"low","line_start":162},{"id":"blocker:references/enterprise/security_rules.md:286:system-reconnaissance","file":"references/enterprise/security_rules.md","pattern":"System reconnaissance","snippet":"fields. Firestore automatically ensures they are logically valid dates.","category":"blocker","line_end":286,"severity":"low","line_start":286},{"id":"blocker:references/enterprise/security_rules.md:335:system-reconnaissance","file":"references/enterprise/security_rules.md","pattern":"System reconnaissance","snippet":"are strings of a valid UID length) to prevent data corruption or schema","category":"blocker","line_end":335,"severity":"low","line_start":335},{"id":"blocker:references/enterprise/security_rules.md:373:system-reconnaissance","file":"references/enterprise/security_rules.md","pattern":"System reconnaissance","snippet":"valid previous state to a valid new state. This prevents users from bypassing","category":"blocker","line_end":373,"severity":"low","line_start":373},{"id":"blocker:references/enterprise/security_rules.md:394:system-reconnaissance","file":"references/enterprise/security_rules.md","pattern":"System reconnaissance","snippet":"document ID), you **MUST** ensure it is correctly scoped to the user or valid","category":"blocker","line_end":395,"severity":"low","line_start":394},{"id":"blocker:references/enterprise/security_rules.md:430:system-reconnaissance","file":"references/enterprise/security_rules.md","pattern":"System reconnaissance","snippet":"!exists(/databases/$(database)/documents/votes/$(request.auth.uid + '_' + docId)) &&","category":"blocker","line_end":430,"severity":"low","line_start":430},{"id":"blocker:references/enterprise/security_rules.md:431:system-reconnaissance","file":"references/enterprise/security_rules.md","pattern":"System reconnaissance","snippet":"getAfter(/databases/$(database)/documents/votes/$(request.auth.uid + '_' + docId)) != null) ||","category":"blocker","line_end":431,"severity":"low","line_start":431},{"id":"blocker:references/enterprise/security_rules.md:434:system-reconnaissance","file":"references/enterprise/security_rules.md","pattern":"System reconnaissance","snippet":"exists(/databases/$(database)/documents/votes/$(request.auth.uid + '_' + docId)) &&","category":"blocker","line_end":434,"severity":"low","line_start":434},{"id":"blocker:references/enterprise/security_rules.md:435:system-reconnaissance","file":"references/enterprise/security_rules.md","pattern":"System reconnaissance","snippet":"getAfter(/databases/$(database)/documents/votes/$(request.auth.uid + '_' + docId)) == null)","category":"blocker","line_end":435,"severity":"low","line_start":435},{"id":"blocker:references/enterprise/security_rules.md:478:system-reconnaissance","file":"references/enterprise/security_rules.md","pattern":"System reconnaissance","snippet":"3.  **The \"Update Bypass\":** Can I `create` a valid document and then `update`","category":"blocker","line_end":478,"severity":"low","line_start":478},{"id":"blocker:references/enterprise/security_rules.md:479:system-reconnaissance","file":"references/enterprise/security_rules.md","pattern":"System reconnaissance","snippet":"it with a 1MB string or invalid fields? (Tests if validation logic is","category":"blocker","line_end":479,"severity":"low","line_start":479},{"id":"blocker:references/enterprise/security_rules.md:489:system-reconnaissance","file":"references/enterprise/security_rules.md","pattern":"System reconnaissance","snippet":"8.  **Validation Bypass (Create vs. Update):** Can I `create` a valid document","category":"blocker","line_end":489,"severity":"low","line_start":489},{"id":"blocker:references/enterprise/security_rules.md:490:system-reconnaissance","file":"references/enterprise/security_rules.md","pattern":"System reconnaissance","snippet":"and then `update` it into an invalid state (e.g., remove a required field,","category":"blocker","line_end":490,"severity":"low","line_start":490},{"id":"blocker:references/enterprise/security_rules.md:504:system-reconnaissance","file":"references/enterprise/security_rules.md","pattern":"System reconnaissance","snippet":"13. **Invalid State Transition:** Can I update a document's `status` field from","category":"blocker","line_end":504,"severity":"low","line_start":504},{"id":"blocker:references/enterprise/security_rules.md:566:system-reconnaissance","file":"references/enterprise/security_rules.md","pattern":"System reconnaissance","snippet":"generation, you should describe the rules you've written as a solid","category":"blocker","line_end":567,"severity":"low","line_start":566},{"id":"blocker:references/enterprise/security_rules.md:58:network-reconnaissance","file":"references/enterprise/security_rules.md","pattern":"Network reconnaissance","snippet":"-   **Authentication checks:** Verify user identity before granting access","category":"blocker","line_end":59,"severity":"low","line_start":58},{"id":"blocker:references/enterprise/web_sdk_usage.md:39:system-reconnaissance","file":"references/enterprise/web_sdk_usage.md","pattern":"System reconnaissance","snippet":"dynamically at the database level via pipeline stages. Avoid local","category":"blocker","line_end":39,"severity":"low","line_start":39},{"id":"network:references/standard/android_sdk_usage.md:21:hardcoded-url","file":"references/standard/android_sdk_usage.md","pattern":"Hardcoded URL","snippet":"// [AGENT] Fetch the latest available BoM version from https://firebase.google.com/support/release-n","category":"network","line_end":21,"severity":"low","line_start":21},{"id":"blocker:references/standard/android_sdk_usage.md:1:system-reconnaissance","file":"references/standard/android_sdk_usage.md","pattern":"System reconnaissance","snippet":"# Cloud Firestore on Android (Kotlin)","category":"blocker","line_end":1,"severity":"low","line_start":1},{"id":"blocker:references/standard/android_sdk_usage.md:3:system-reconnaissance","file":"references/standard/android_sdk_usage.md","pattern":"System reconnaissance","snippet":"This guide walks you through using Cloud Firestore in your Android app using Kotlin.","category":"blocker","line_end":3,"severity":"low","line_start":3},{"id":"blocker:references/standard/android_sdk_usage.md:21:system-reconnaissance","file":"references/standard/android_sdk_usage.md","pattern":"System reconnaissance","snippet":"// [AGENT] Fetch the latest available BoM version from https://firebase.google.com/support/release-n","category":"blocker","line_end":21,"severity":"low","line_start":21},{"id":"external_commands:references/standard/security_rules.md:430:shell-command-substitution","file":"references/standard/security_rules.md","pattern":"Shell command substitution","snippet":"!exists(/databases/$(database)/documents/votes/$(request.auth.uid + '_' + docId)) &&","category":"external_commands","line_end":430,"severity":"medium","line_start":430},{"id":"external_commands:references/standard/security_rules.md:431:shell-command-substitution","file":"references/standard/security_rules.md","pattern":"Shell command substitution","snippet":"getAfter(/databases/$(database)/documents/votes/$(request.auth.uid + '_' + docId)) != null) ||","category":"external_commands","line_end":431,"severity":"medium","line_start":431},{"id":"external_commands:references/standard/security_rules.md:434:shell-command-substitution","file":"references/standard/security_rules.md","pattern":"Shell command substitution","snippet":"exists(/databases/$(database)/documents/votes/$(request.auth.uid + '_' + docId)) &&","category":"external_commands","line_end":434,"severity":"medium","line_start":434},{"id":"external_commands:references/standard/security_rules.md:435:shell-command-substitution","file":"references/standard/security_rules.md","pattern":"Shell command substitution","snippet":"getAfter(/databases/$(database)/documents/votes/$(request.auth.uid + '_' + docId)) == null)","category":"external_commands","line_end":435,"severity":"medium","line_start":435},{"id":"network:references/standard/security_rules.md:141:hardcoded-url","file":"references/standard/security_rules.md","pattern":"Hardcoded URL","snippet":"(url.matches(\"^https://.*\") || url.matches(\"^http://.*\"));","category":"network","line_end":141,"severity":"low","line_start":141},{"id":"sensitive:references/standard/security_rules.md:128:certificate-key-files","file":"references/standard/security_rules.md","pattern":"Certificate/key files","snippet":"return request.resource.data.keys().hasAll(fields);","category":"sensitive","line_end":128,"severity":"high","line_start":128},{"id":"sensitive:references/standard/security_rules.md:185:certificate-key-files","file":"references/standard/security_rules.md","pattern":"Certificate/key files","snippet":"return mapData is map && mapData.keys().hasOnly(allowedKeys);","category":"sensitive","line_end":185,"severity":"high","line_start":185},{"id":"sensitive:references/standard/security_rules.md:190:certificate-key-files","file":"references/standard/security_rules.md","pattern":"Certificate/key files","snippet":"return request.resource.data.keys().hasOnly(fields);","category":"sensitive","line_end":190,"severity":"high","line_start":190},{"id":"sensitive:references/standard/security_rules.md:517:crypto-seed-private-key-mention","file":"references/standard/security_rules.md","pattern":"Crypto seed/private key mention","snippet":"document also contain User A's email or private keys? If both are true, the","category":"sensitive","line_end":517,"severity":"high","line_start":517},{"id":"blocker:references/standard/security_rules.md:6:system-reconnaissance","file":"references/standard/security_rules.md","pattern":"System reconnaissance","snippet":"security incidents and avoid misleading the user about the security of their","category":"blocker","line_end":6,"severity":"low","line_start":6},{"id":"blocker:references/standard/security_rules.md:92:system-reconnaissance","file":"references/standard/security_rules.md","pattern":"System reconnaissance","snippet":"1.  **Include comprehensive helper functions to avoid repetition:**","category":"blocker","line_end":92,"severity":"low","line_start":92},{"id":"blocker:references/standard/security_rules.md:106:system-reconnaissance","file":"references/standard/security_rules.md","pattern":"System reconnaissance","snippet":"return isAuthenticated() && request.auth.uid == userId;","category":"blocker","line_end":106,"severity":"low","line_start":106},{"id":"blocker:references/standard/security_rules.md:109:system-reconnaissance","file":"references/standard/security_rules.md","pattern":"System reconnaissance","snippet":"// Check if user is owner based on document's uid field","category":"blocker","line_end":109,"severity":"low","line_start":109},{"id":"blocker:references/standard/security_rules.md:111:system-reconnaissance","file":"references/standard/security_rules.md","pattern":"System reconnaissance","snippet":"return isAuthenticated() && request.auth.uid == resource.data.uid;","category":"blocker","line_end":111,"severity":"low","line_start":111},{"id":"blocker:references/standard/security_rules.md:117:system-reconnaissance","file":"references/standard/security_rules.md","pattern":"System reconnaissance","snippet":"request.resource.data.uid == request.auth.uid;","category":"blocker","line_end":117,"severity":"low","line_start":117},{"id":"blocker:references/standard/security_rules.md:120:system-reconnaissance","file":"references/standard/security_rules.md","pattern":"System reconnaissance","snippet":"// Ensure uid field is not modified on update","category":"blocker","line_end":120,"severity":"low","line_start":120},{"id":"blocker:references/standard/security_rules.md:123:system-reconnaissance","file":"references/standard/security_rules.md","pattern":"System reconnaissance","snippet":"request.resource.data.uid == resource.data.uid;","category":"blocker","line_end":123,"severity":"low","line_start":123},{"id":"blocker:references/standard/security_rules.md:162:system-reconnaissance","file":"references/standard/security_rules.md","pattern":"System reconnaissance","snippet":"return path is string && path.matches(\"^users/\" + request.auth.uid + \"/.*\");","category":"blocker","line_end":162,"severity":"low","line_start":162},{"id":"blocker:references/standard/security_rules.md:286:system-reconnaissance","file":"references/standard/security_rules.md","pattern":"System reconnaissance","snippet":"fields. Firestore automatically ensures they are logically valid dates.","category":"blocker","line_end":286,"severity":"low","line_start":286},{"id":"blocker:references/standard/security_rules.md:335:system-reconnaissance","file":"references/standard/security_rules.md","pattern":"System reconnaissance","snippet":"are strings of a valid UID length) to prevent data corruption or schema","category":"blocker","line_end":335,"severity":"low","line_start":335},{"id":"blocker:references/standard/security_rules.md:373:system-reconnaissance","file":"references/standard/security_rules.md","pattern":"System reconnaissance","snippet":"valid previous state to a valid new state. This prevents users from bypassing","category":"blocker","line_end":373,"severity":"low","line_start":373},{"id":"blocker:references/standard/security_rules.md:394:system-reconnaissance","file":"references/standard/security_rules.md","pattern":"System reconnaissance","snippet":"document ID), you **MUST** ensure it is correctly scoped to the user or valid","category":"blocker","line_end":395,"severity":"low","line_start":394},{"id":"blocker:references/standard/security_rules.md:430:system-reconnaissance","file":"references/standard/security_rules.md","pattern":"System reconnaissance","snippet":"!exists(/databases/$(database)/documents/votes/$(request.auth.uid + '_' + docId)) &&","category":"blocker","line_end":430,"severity":"low","line_start":430},{"id":"blocker:references/standard/security_rules.md:431:system-reconnaissance","file":"references/standard/security_rules.md","pattern":"System reconnaissance","snippet":"getAfter(/databases/$(database)/documents/votes/$(request.auth.uid + '_' + docId)) != null) ||","category":"blocker","line_end":431,"severity":"low","line_start":431},{"id":"blocker:references/standard/security_rules.md:434:system-reconnaissance","file":"references/standard/security_rules.md","pattern":"System reconnaissance","snippet":"exists(/databases/$(database)/documents/votes/$(request.auth.uid + '_' + docId)) &&","category":"blocker","line_end":434,"severity":"low","line_start":434},{"id":"blocker:references/standard/security_rules.md:435:system-reconnaissance","file":"references/standard/security_rules.md","pattern":"System reconnaissance","snippet":"getAfter(/databases/$(database)/documents/votes/$(request.auth.uid + '_' + docId)) == null)","category":"blocker","line_end":435,"severity":"low","line_start":435},{"id":"blocker:references/standard/security_rules.md:478:system-reconnaissance","file":"references/standard/security_rules.md","pattern":"System reconnaissance","snippet":"3.  **The \"Update Bypass\":** Can I `create` a valid document and then `update`","category":"blocker","line_end":478,"severity":"low","line_start":478},{"id":"blocker:references/standard/security_rules.md:479:system-reconnaissance","file":"references/standard/security_rules.md","pattern":"System reconnaissance","snippet":"it with a 1MB string or invalid fields? (Tests if validation logic is","category":"blocker","line_end":479,"severity":"low","line_start":479},{"id":"blocker:references/standard/security_rules.md:489:system-reconnaissance","file":"references/standard/security_rules.md","pattern":"System reconnaissance","snippet":"8.  **Validation Bypass (Create vs. Update):** Can I `create` a valid document","category":"blocker","line_end":489,"severity":"low","line_start":489},{"id":"blocker:references/standard/security_rules.md:490:system-reconnaissance","file":"references/standard/security_rules.md","pattern":"System reconnaissance","snippet":"and then `update` it into an invalid state (e.g., remove a required field,","category":"blocker","line_end":490,"severity":"low","line_start":490},{"id":"blocker:references/standard/security_rules.md:504:system-reconnaissance","file":"references/standard/security_rules.md","pattern":"System reconnaissance","snippet":"13. **Invalid State Transition:** Can I update a document's `status` field from","category":"blocker","line_end":504,"severity":"low","line_start":504},{"id":"blocker:references/standard/security_rules.md:566:system-reconnaissance","file":"references/standard/security_rules.md","pattern":"System reconnaissance","snippet":"generation, you should describe the rules you've written as a solid","category":"blocker","line_end":567,"severity":"low","line_start":566},{"id":"blocker:references/standard/security_rules.md:58:network-reconnaissance","file":"references/standard/security_rules.md","pattern":"Network reconnaissance","snippet":"-   **Authentication checks:** Verify user identity before granting access","category":"blocker","line_end":59,"severity":"low","line_start":58},{"id":"external_commands:SKILL.md:9:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"compatibility: This skill is best used with the Firebase CLI, but does not require it. Firebase CLI ","category":"external_commands","line_end":9,"severity":"medium","line_start":9},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Run the following command to list current Firestore databases: `bash npx -y","category":"external_commands","line_end":20,"severity":"medium","line_start":19},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1.  For each database found, inspect its edition and details: `bash npx -y","category":"external_commands","line_end":25,"severity":"medium","line_start":24},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"-   If the **`edition`** is `STANDARD`, follow the guides under","category":"external_commands","line_end":29,"severity":"medium","line_start":29},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`references/standard/`.","category":"external_commands","line_end":30,"severity":"medium","line_start":30},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"-   If the **`edition`** is `ENTERPRISE` or native mode, follow the guides","category":"external_commands","line_end":31,"severity":"medium","line_start":31},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"under `references/enterprise/`.","category":"external_commands","line_end":32,"severity":"medium","line_start":32},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Run `npx -y firebase-tools@latest firestore:locations` to get the list of options.","category":"external_commands","line_end":38,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`bash npx -y firebase-tools@latest firestore:databases:create <database-id> --edition=\"enterprise\" -","category":"external_commands","line_end":42,"severity":"medium","line_start":42},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Proceed with using the guides under `references/enterprise/`.","category":"external_commands","line_end":44,"severity":"medium","line_start":44},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### Standard Edition (`references/standard/`)","category":"external_commands","line_end":53,"severity":"medium","line_start":53},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### Enterprise Edition / Native Mode (`references/enterprise/`)","category":"external_commands","line_end":60,"severity":"medium","line_start":60}],"finding_verdicts":[{"id":"network:references/enterprise/android_sdk_usage.md:21:hardcoded-url","reason":"The URL points to Firebase release notes so the user can choose a current dependency version. No data is sent to an external service, and no runtime network call is defined.","verdict":"false_positive","confidence":0.93},{"id":"blocker:references/enterprise/android_sdk_usage.md:1:system-reconnaissance","reason":"The content is platform setup guidance for Firestore SDK usage. It does not enumerate the host system, collect environment data, or bypass user control.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/enterprise/android_sdk_usage.md:3:system-reconnaissance","reason":"The content is platform setup guidance for Firestore SDK usage. It does not enumerate the host system, collect environment data, or bypass user control.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/enterprise/android_sdk_usage.md:21:system-reconnaissance","reason":"The content is platform setup guidance for Firestore SDK usage. It does not enumerate the host system, collect environment data, or bypass user control.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/enterprise/indexes.md:6:system-reconnaissance","reason":"The line discusses Firestore index performance for large collections. It is database design guidance, not system reconnaissance.","verdict":"false_positive","confidence":0.93},{"id":"blocker:references/enterprise/provisioning.md:25:system-reconnaissance","reason":"The line is a Firebase CLI database creation example that can modify cloud resources if copied and run. It is not system reconnaissance, but the operational impact warrants keeping it as a low-risk finding.","verdict":"confirmed","severity":"low","confidence":0.68},{"id":"blocker:references/enterprise/provisioning.md:33:system-reconnaissance","reason":"The content explains Firestore database provisioning concepts and placeholders. It does not perform host reconnaissance or gather local system information.","verdict":"false_positive","confidence":0.86},{"id":"blocker:references/enterprise/provisioning.md:38:system-reconnaissance","reason":"The line is a Firebase CLI database creation example that can modify cloud resources if copied and run. It is not system reconnaissance, but the operational impact warrants keeping it as a low-risk finding.","verdict":"confirmed","severity":"low","confidence":0.68},{"id":"external_commands:references/enterprise/security_rules.md:430:shell-command-substitution","reason":"The syntax uses Firestore Security Rules path interpolation such as database and request auth values. It is not shell command substitution and does not execute an operating system command.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:references/enterprise/security_rules.md:431:shell-command-substitution","reason":"The syntax uses Firestore Security Rules path interpolation such as database and request auth values. It is not shell command substitution and does not execute an operating system command.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:references/enterprise/security_rules.md:434:shell-command-substitution","reason":"The syntax uses Firestore Security Rules path interpolation such as database and request auth values. It is not shell command substitution and does not execute an operating system command.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:references/enterprise/security_rules.md:435:shell-command-substitution","reason":"The syntax uses Firestore Security Rules path interpolation such as database and request auth values. It is not shell command substitution and does not execute an operating system command.","verdict":"false_positive","confidence":0.98},{"id":"network:references/enterprise/security_rules.md:141:hardcoded-url","reason":"The line is a regular expression that validates whether a string starts with http or https. It does not perform network access or contact a remote host.","verdict":"false_positive","confidence":0.96},{"id":"sensitive:references/enterprise/security_rules.md:128:certificate-key-files","reason":"The match is the Firestore Rules keys() method for validating document fields. It is not a certificate file, key file, or embedded secret.","verdict":"false_positive","confidence":0.97},{"id":"sensitive:references/enterprise/security_rules.md:185:certificate-key-files","reason":"The match is the Firestore Rules keys() method for validating document fields. It is not a certificate file, key file, or embedded secret.","verdict":"false_positive","confidence":0.97},{"id":"sensitive:references/enterprise/security_rules.md:190:certificate-key-files","reason":"The match is the Firestore Rules keys() method for validating document fields. It is not a certificate file, key file, or embedded secret.","verdict":"false_positive","confidence":0.97},{"id":"sensitive:references/enterprise/security_rules.md:517:crypto-seed-private-key-mention","reason":"The text is a defensive checklist item warning against exposing private keys in readable documents. No private key, seed phrase, or credential value is present.","verdict":"false_positive","confidence":0.92},{"id":"blocker:references/enterprise/security_rules.md:6:system-reconnaissance","reason":"The line belongs to Firestore Security Rules guidance about validation and authorization. It does not collect system data or probe the local environment.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/enterprise/security_rules.md:92:system-reconnaissance","reason":"The line belongs to Firestore Security Rules guidance about validation and authorization. It does not collect system data or probe the local environment.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/enterprise/security_rules.md:106:system-reconnaissance","reason":"The line belongs to Firestore Security Rules guidance about validation and authorization. It does not collect system data or probe the local environment.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/enterprise/security_rules.md:109:system-reconnaissance","reason":"The line belongs to Firestore Security Rules guidance about validation and authorization. It does not collect system data or probe the local environment.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/enterprise/security_rules.md:111:system-reconnaissance","reason":"The line belongs to Firestore Security Rules guidance about validation and authorization. It does not collect system data or probe the local environment.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/enterprise/security_rules.md:117:system-reconnaissance","reason":"The line belongs to Firestore Security Rules guidance about validation and authorization. It does not collect system data or probe the local environment.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/enterprise/security_rules.md:120:system-reconnaissance","reason":"The line belongs to Firestore Security Rules guidance about validation and authorization. It does not collect system data or probe the local environment.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/enterprise/security_rules.md:123:system-reconnaissance","reason":"The line belongs to Firestore Security Rules guidance about validation and authorization. It does not collect system data or probe the local environment.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/enterprise/security_rules.md:162:system-reconnaissance","reason":"The line belongs to Firestore Security Rules guidance about validation and authorization. It does not collect system data or probe the local environment.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/enterprise/security_rules.md:286:system-reconnaissance","reason":"The line belongs to Firestore Security Rules guidance about validation and authorization. It does not collect system data or probe the local environment.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/enterprise/security_rules.md:335:system-reconnaissance","reason":"The line belongs to Firestore Security Rules guidance about validation and authorization. It does not collect system data or probe the local environment.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/enterprise/security_rules.md:373:system-reconnaissance","reason":"The line belongs to Firestore Security Rules guidance about validation and authorization. It does not collect system data or probe the local environment.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/enterprise/security_rules.md:394:system-reconnaissance","reason":"The line belongs to Firestore Security Rules guidance about validation and authorization. It does not collect system data or probe the local environment.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/enterprise/security_rules.md:430:system-reconnaissance","reason":"The line is part of a Firestore rules consistency check using rule-language document paths. It is not operating system reconnaissance or command execution.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/enterprise/security_rules.md:431:system-reconnaissance","reason":"The line is part of a Firestore rules consistency check using rule-language document paths. It is not operating system reconnaissance or command execution.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/enterprise/security_rules.md:434:system-reconnaissance","reason":"The line is part of a Firestore rules consistency check using rule-language document paths. It is not operating system reconnaissance or command execution.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/enterprise/security_rules.md:435:system-reconnaissance","reason":"The line is part of a Firestore rules consistency check using rule-language document paths. It is not operating system reconnaissance or command execution.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/enterprise/security_rules.md:478:system-reconnaissance","reason":"The text is defensive security guidance for testing Firestore rules and communicating review limits. It does not instruct host reconnaissance or malicious enumeration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/enterprise/security_rules.md:479:system-reconnaissance","reason":"The text is defensive security guidance for testing Firestore rules and communicating review limits. It does not instruct host reconnaissance or malicious enumeration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/enterprise/security_rules.md:489:system-reconnaissance","reason":"The text is defensive security guidance for testing Firestore rules and communicating review limits. It does not instruct host reconnaissance or malicious enumeration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/enterprise/security_rules.md:490:system-reconnaissance","reason":"The text is defensive security guidance for testing Firestore rules and communicating review limits. It does not instruct host reconnaissance or malicious enumeration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/enterprise/security_rules.md:504:system-reconnaissance","reason":"The text is defensive security guidance for testing Firestore rules and communicating review limits. It does not instruct host reconnaissance or malicious enumeration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/enterprise/security_rules.md:566:system-reconnaissance","reason":"The text is defensive security guidance for testing Firestore rules and communicating review limits. It does not instruct host reconnaissance or malicious enumeration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/enterprise/security_rules.md:58:network-reconnaissance","reason":"The text is defensive security guidance for testing Firestore rules and communicating review limits. It does not instruct host reconnaissance or malicious enumeration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/enterprise/web_sdk_usage.md:39:system-reconnaissance","reason":"The line advises pushing filtering and aggregation into Firestore query pipelines. It is performance guidance, not reconnaissance or data collection.","verdict":"false_positive","confidence":0.91},{"id":"network:references/standard/android_sdk_usage.md:21:hardcoded-url","reason":"The URL points to Firebase release notes so the user can choose a current dependency version. No data is sent to an external service, and no runtime network call is defined.","verdict":"false_positive","confidence":0.93},{"id":"blocker:references/standard/android_sdk_usage.md:1:system-reconnaissance","reason":"The content is platform setup guidance for Firestore SDK usage. It does not enumerate the host system, collect environment data, or bypass user control.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/standard/android_sdk_usage.md:3:system-reconnaissance","reason":"The content is platform setup guidance for Firestore SDK usage. It does not enumerate the host system, collect environment data, or bypass user control.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/standard/android_sdk_usage.md:21:system-reconnaissance","reason":"The content is platform setup guidance for Firestore SDK usage. It does not enumerate the host system, collect environment data, or bypass user control.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:references/standard/security_rules.md:430:shell-command-substitution","reason":"The syntax uses Firestore Security Rules path interpolation such as database and request auth values. It is not shell command substitution and does not execute an operating system command.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:references/standard/security_rules.md:431:shell-command-substitution","reason":"The syntax uses Firestore Security Rules path interpolation such as database and request auth values. It is not shell command substitution and does not execute an operating system command.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:references/standard/security_rules.md:434:shell-command-substitution","reason":"The syntax uses Firestore Security Rules path interpolation such as database and request auth values. It is not shell command substitution and does not execute an operating system command.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:references/standard/security_rules.md:435:shell-command-substitution","reason":"The syntax uses Firestore Security Rules path interpolation such as database and request auth values. It is not shell command substitution and does not execute an operating system command.","verdict":"false_positive","confidence":0.98},{"id":"network:references/standard/security_rules.md:141:hardcoded-url","reason":"The line is a regular expression that validates whether a string starts with http or https. It does not perform network access or contact a remote host.","verdict":"false_positive","confidence":0.96},{"id":"sensitive:references/standard/security_rules.md:128:certificate-key-files","reason":"The match is the Firestore Rules keys() method for validating document fields. It is not a certificate file, key file, or embedded secret.","verdict":"false_positive","confidence":0.97},{"id":"sensitive:references/standard/security_rules.md:185:certificate-key-files","reason":"The match is the Firestore Rules keys() method for validating document fields. It is not a certificate file, key file, or embedded secret.","verdict":"false_positive","confidence":0.97},{"id":"sensitive:references/standard/security_rules.md:190:certificate-key-files","reason":"The match is the Firestore Rules keys() method for validating document fields. It is not a certificate file, key file, or embedded secret.","verdict":"false_positive","confidence":0.97},{"id":"sensitive:references/standard/security_rules.md:517:crypto-seed-private-key-mention","reason":"The text is a defensive checklist item warning against exposing private keys in readable documents. No private key, seed phrase, or credential value is present.","verdict":"false_positive","confidence":0.92},{"id":"blocker:references/standard/security_rules.md:6:system-reconnaissance","reason":"The line belongs to Firestore Security Rules guidance about validation and authorization. It does not collect system data or probe the local environment.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/standard/security_rules.md:92:system-reconnaissance","reason":"The line belongs to Firestore Security Rules guidance about validation and authorization. It does not collect system data or probe the local environment.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/standard/security_rules.md:106:system-reconnaissance","reason":"The line belongs to Firestore Security Rules guidance about validation and authorization. It does not collect system data or probe the local environment.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/standard/security_rules.md:109:system-reconnaissance","reason":"The line belongs to Firestore Security Rules guidance about validation and authorization. It does not collect system data or probe the local environment.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/standard/security_rules.md:111:system-reconnaissance","reason":"The line belongs to Firestore Security Rules guidance about validation and authorization. It does not collect system data or probe the local environment.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/standard/security_rules.md:117:system-reconnaissance","reason":"The line belongs to Firestore Security Rules guidance about validation and authorization. It does not collect system data or probe the local environment.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/standard/security_rules.md:120:system-reconnaissance","reason":"The line belongs to Firestore Security Rules guidance about validation and authorization. It does not collect system data or probe the local environment.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/standard/security_rules.md:123:system-reconnaissance","reason":"The line belongs to Firestore Security Rules guidance about validation and authorization. It does not collect system data or probe the local environment.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/standard/security_rules.md:162:system-reconnaissance","reason":"The line belongs to Firestore Security Rules guidance about validation and authorization. It does not collect system data or probe the local environment.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/standard/security_rules.md:286:system-reconnaissance","reason":"The line belongs to Firestore Security Rules guidance about validation and authorization. It does not collect system data or probe the local environment.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/standard/security_rules.md:335:system-reconnaissance","reason":"The line belongs to Firestore Security Rules guidance about validation and authorization. It does not collect system data or probe the local environment.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/standard/security_rules.md:373:system-reconnaissance","reason":"The line belongs to Firestore Security Rules guidance about validation and authorization. It does not collect system data or probe the local environment.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/standard/security_rules.md:394:system-reconnaissance","reason":"The line belongs to Firestore Security Rules guidance about validation and authorization. It does not collect system data or probe the local environment.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/standard/security_rules.md:430:system-reconnaissance","reason":"The line is part of a Firestore rules consistency check using rule-language document paths. It is not operating system reconnaissance or command execution.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/standard/security_rules.md:431:system-reconnaissance","reason":"The line is part of a Firestore rules consistency check using rule-language document paths. It is not operating system reconnaissance or command execution.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/standard/security_rules.md:434:system-reconnaissance","reason":"The line is part of a Firestore rules consistency check using rule-language document paths. It is not operating system reconnaissance or command execution.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/standard/security_rules.md:435:system-reconnaissance","reason":"The line is part of a Firestore rules consistency check using rule-language document paths. It is not operating system reconnaissance or command execution.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/standard/security_rules.md:478:system-reconnaissance","reason":"The text is defensive security guidance for testing Firestore rules and communicating review limits. It does not instruct host reconnaissance or malicious enumeration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/standard/security_rules.md:479:system-reconnaissance","reason":"The text is defensive security guidance for testing Firestore rules and communicating review limits. It does not instruct host reconnaissance or malicious enumeration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/standard/security_rules.md:489:system-reconnaissance","reason":"The text is defensive security guidance for testing Firestore rules and communicating review limits. It does not instruct host reconnaissance or malicious enumeration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/standard/security_rules.md:490:system-reconnaissance","reason":"The text is defensive security guidance for testing Firestore rules and communicating review limits. It does not instruct host reconnaissance or malicious enumeration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/standard/security_rules.md:504:system-reconnaissance","reason":"The text is defensive security guidance for testing Firestore rules and communicating review limits. It does not instruct host reconnaissance or malicious enumeration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/standard/security_rules.md:566:system-reconnaissance","reason":"The text is defensive security guidance for testing Firestore rules and communicating review limits. It does not instruct host reconnaissance or malicious enumeration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/standard/security_rules.md:58:network-reconnaissance","reason":"The text is defensive security guidance for testing Firestore rules and communicating review limits. It does not instruct host reconnaissance or malicious enumeration.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:9:ruby-shell-backtick-execution","reason":"The compatibility note recommends accessing Firebase CLI through npx with the latest package. That can download and execute external npm code, so it is a real supply-chain and command execution concern.","verdict":"confirmed","severity":"medium","confidence":0.76},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","reason":"This instruction runs Firebase CLI through npx with the latest firebase-tools package. The command is for legitimate Firestore administration, but it executes external tooling from npm.","verdict":"confirmed","severity":"medium","confidence":0.86},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","reason":"This instruction runs Firebase CLI through npx with the latest firebase-tools package. The command is for legitimate Firestore administration, but it executes external tooling from npm.","verdict":"confirmed","severity":"medium","confidence":0.86},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","reason":"The backticks mark inline text, headings, or reference paths in Markdown. They do not define a command for the agent or shell to execute.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","reason":"The backticks mark inline text, headings, or reference paths in Markdown. They do not define a command for the agent or shell to execute.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","reason":"The backticks mark inline text, headings, or reference paths in Markdown. They do not define a command for the agent or shell to execute.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","reason":"The backticks mark inline text, headings, or reference paths in Markdown. They do not define a command for the agent or shell to execute.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"This instruction runs Firebase CLI through npx with the latest firebase-tools package. The command is for legitimate Firestore administration, but it executes external tooling from npm.","verdict":"confirmed","severity":"medium","confidence":0.86},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","reason":"This line directs use of Firebase CLI to create a Firestore database, which can change cloud resources. It is legitimate tooling, but it requires explicit user confirmation and project context.","verdict":"confirmed","severity":"medium","confidence":0.9},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","reason":"The backticks mark inline text, headings, or reference paths in Markdown. They do not define a command for the agent or shell to execute.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","reason":"The backticks mark inline text, headings, or reference paths in Markdown. They do not define a command for the agent or shell to execute.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","reason":"The backticks mark inline text, headings, or reference paths in Markdown. They do not define a command for the agent or shell to execute.","verdict":"false_positive","confidence":0.94}],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"low","confirmedFindingCount":2,"capabilityReviewCount":5,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}