Habilidades firebase-development-debug Historial de auditorías
📦

Historial de auditorías

firebase-development-debug - 4 auditorías

Versión de auditoría 4

Más reciente Riesgo medio

Jun 27, 2026, 03:28 PM

Static analysis found shell commands, localhost network access, and environment-file inspection guidance. Review confirms these are mostly legitimate Firebase debugging instructions, but reading .env files and killing processes creates elevated operational risk. No evidence found of malicious exfiltration, prompt injection, or hidden executable payloads.

1
Archivos escaneados
183
Líneas analizadas
9
hallazgos
codex
Auditado por
Problemas de riesgo medio (2)
Shell and Process Management Commands in Debug Workflow
The skill recommends shell commands for port checks, process termination, Firebase emulator control, exports, and build checks. These commands are normal for Firebase debugging, but they can disrupt local services or change emulator state if run without review. Verdict: true positive for operational command risk, not evidence of malicious execution.
Sensitive Environment File Inspection Guidance
The skill tells the agent to read functions/.env and hosting/.env.local while diagnosing auth configuration. This is a legitimate troubleshooting step, but it may expose secrets in the AI context or logs. Verdict: true positive for sensitive file access risk.
Problemas de riesgo bajo (3)
Localhost Network URL Flag Is Low Risk
The hardcoded URL points to 127.0.0.1 for the Firebase Emulator UI. This supports local debugging and does not indicate external communication. Verdict: false positive for external network risk.
Descriptive Text Triggered Heuristic False Positives
The weak cryptographic algorithm and system reconnaissance flags map to descriptive Firebase debugging text, not cryptographic calls or host reconnaissance code. Verdict: false positive for these blocker findings.
Reference Backticks Are Not Command Execution
Several static command findings point to backticked skill names and documentation paths. These references do not execute code by themselves. Verdict: false positive for Ruby or shell backtick execution on these lines.

Patrones detectados

Command Guidance Combined With Secret File Reads

Versión de auditoría 3

Seguro

Jan 16, 2026, 01:38 PM

This is a pure documentation skill containing only markdown guidance. Static scanner findings are all false positives - JSON metadata fields were misidentified as security threats, bash code blocks in documentation were flagged as execution risks, and localhost emulator URLs were detected as network issues. No executable code exists in this skill.

2
Archivos escaneados
362
Líneas analizadas
3
hallazgos
claude
Auditado por
No se encontraron problemas de seguridad

Versión de auditoría 2

Seguro

Jan 16, 2026, 01:38 PM

This is a pure documentation skill containing only markdown guidance. Static scanner findings are all false positives - JSON metadata fields were misidentified as security threats, bash code blocks in documentation were flagged as execution risks, and localhost emulator URLs were detected as network issues. No executable code exists in this skill.

2
Archivos escaneados
362
Líneas analizadas
3
hallazgos
claude
Auditado por
No se encontraron problemas de seguridad

Versión de auditoría 1

Seguro

Jan 10, 2026, 09:20 AM

This is a pure documentation skill containing only markdown text and workflow guidance. No executable code, scripts, network calls, or file system access. The skill provides debugging instructions for Firebase development issues.

1
Archivos escaneados
183
Líneas analizadas
0
hallazgos
claude
Auditado por
No se encontraron problemas de seguridad