スキル firestore-rules-creation
📦
firestore-rules-creation
コンテンツリビジョン r1 高リスク ⚙️ 外部コマンド🌐 ネットワークアクセス
Create Secure Firestore Rules
Firestore Rules can expose private data when access and validation logic are incomplete. This skill helps create structured rules with least-privilege access, schema checks, and security test scenarios.
対応: Claude Codex Code(CC)
インストール前に停止して確認を求めてください。
計画を確認し、ファイルを変更する前にユーザーの明示的な同意を得てください。
自分のエージェントでインストール
このリクエストをエージェントにコピーしてください。正規の Skill ページとマニフェストが含まれています。
エージェントリクエスト
Review the Skillstore skill "firestore-rules-creation" from https://skillstore.io/skills/firebase-firestore-rules-creation.md and its manifest at https://skillstore.io/api/skills/firebase-firestore-rules-creation/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。
エージェントが読めるリソース
AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。
テストする
「firestore-rules-creation」を使用しています。 Create rules for private user profiles and public posts.
期待される結果:
- Assumed data model for profiles and posts.
- Rules that limit profile access to the owner.
- Rules that allow public post reads without exposing profile PII.
- A list of assumptions and tests to run.
「firestore-rules-creation」を使用しています。 Secure a likes counter on each post.
期待される結果:
- A counter-update policy that limits changed fields.
- A consistency check for one like per user.
- A replay and batch-operation test checklist.
セキュリティ監査
高リスクv1 • 2026/9/11 バージョン別レポートを開く
Static detections are false positives caused by Markdown code formatting, Firestore Rules interpolation syntax, and security-focused prose. No command execution, network access, reconnaissance, or credential exposure is present. One semantic issue remains: the guidance to prefer `read` can unintentionally grant both get and list access.
1
スキャンされたファイル
585
解析済み行数
0
レビュー項目
0
誤検知を無視
確認済みのセキュリティ上の懸念 (1)
高
Overbroad Read Permission Guidance
The instruction to prefer `read` over `list` or `get` can overgrant access because Firestore `read` covers both single-document reads and queries. Rules should distinguish `get` and `list` when their authorization requirements differ.
The guidance explicitly prefers the broader Firestore read operation without limiting it to cases where get and list have identical authorization requirements.
リスク要因
⚙️ 外部コマンド (50)
SKILL.md:32 SKILL.md:33 SKILL.md:59 SKILL.md:60 SKILL.md:79-96 SKILL.md:96-100 SKILL.md:100-225 SKILL.md:225-266 SKILL.md:266-273 SKILL.md:273-277 SKILL.md:277-284 SKILL.md:284-288 SKILL.md:288 SKILL.md:289-293 SKILL.md:293-296 SKILL.md:296-299 SKILL.md:299-300 SKILL.md:300-302 SKILL.md:302 SKILL.md:303-304 SKILL.md:304-307 SKILL.md:307 SKILL.md:312 SKILL.md:315-320 SKILL.md:320-334 SKILL.md:334-337 SKILL.md:337-338 SKILL.md:338-343 SKILL.md:343-346 SKILL.md:346-349 SKILL.md:349-352 SKILL.md:352-355 SKILL.md:355-356 SKILL.md:356 SKILL.md:357 SKILL.md:358-375 SKILL.md:375-383 SKILL.md:383-387 SKILL.md:387-393 SKILL.md:393-404 SKILL.md:404-414 SKILL.md:414-417 SKILL.md:417-421 SKILL.md:421 SKILL.md:424 SKILL.md:429-430 SKILL.md:430-435 SKILL.md:435-455 SKILL.md:455-468 SKILL.md:468-469
🌐 ネットワークアクセス (1)
監査者: claude
このレポートを共有・引用
バージョン付き評価レポート、中立的なバッジ、埋め込みカード、引用を共有できます。Skillstore は証拠を報告しますが、この Skill が安全かどうかは判断しません。
レポートリンクをコピー
https://skillstore.io/skills/firebase-firestore-rules-creation/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdownバッジ
[](https://skillstore.io/skills/firebase-firestore-rules-creation?utm_source=security_passport_badge)HTMLバッジ
<a href="https://skillstore.io/skills/firebase-firestore-rules-creation?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/firebase-firestore-rules-creation/security.svg" alt="Skillstore security assessment" loading="lazy"></a>埋め込みカード
<iframe src="https://skillstore.io/embed/skills/firebase-firestore-rules-creation.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学術引用 (APA · BibTeX · CFF)
APA形式の引用
firebase. (2026). firestore-rules-creation security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/firebase-firestore-rules-creation/audits/1BibTeX形式の引用
@techreport{firebase-firebase-firestore-rules-creation-2026,
author = {firebase},
title = {firestore-rules-creation security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/firebase-firestore-rules-creation/audits/1},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "firestore-rules-creation security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
- name: "firebase"
date-released: "2026-09-11"
url: "https://skillstore.io/skills/firebase-firestore-rules-creation/audits/1"
identifiers:
- type: other
value: "skillstore:firebase-firestore-rules-creation:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore スコア
このスコアの理由 証拠の信頼度: 中 55
アーキテクチャ
85
保守性
87
コンテンツ
65
コミュニティ
87
仕様準拠
作成できるもの
Build a new application policy
Create a starting rules file for a new Firestore application with authenticated ownership and schema validation.
Protect collaborative data
Define safe editor, viewer, owner, and administrator permissions for shared documents.
Harden an existing rules file
Refactor existing rules and test for update bypasses, role escalation, data leakage, and unsafe counters.
これらのプロンプトを試す
Start a rules file
Review this project and create a prototype firestore.rules file. List your data model assumptions and require authentication by default.
Add document ownership
Create Firestore Rules for a posts collection. Authors can create, read, update, and delete only their own posts. Validate title, body, author ID, and timestamps.
Model role-based access
Design Firestore Rules for a workspace application with owners, editors, and viewers. Keep role fields immutable for non-owners and validate every update.
Test complex business logic
Refactor these Firestore Rules and perform the full attack checklist. Check counters, state transitions, collection queries, PII separation, and batch consistency.
ベストプラクティス
- Provide real collection paths, field types, queries, and user roles before generating rules.
- Test rules in the Firebase Emulator Suite with allowed and denied requests.
- Review generated rules before deployment and repeat tests after each schema change.
回避
- Do not use generated rules unchanged when application requirements are uncertain.
- Do not store public profile data and private personal data in the same document.
- Do not grant broad read or write access merely to resolve permission errors.
よくある質問
What does this skill create?
It creates or refines a prototype Firestore Rules file and documents assumptions, validation, and test scenarios.
Does it make Firestore Rules secure by itself?
No. You must review the rules against your application behavior and test them before production use.
Can it support public data?
Yes. Describe which collections and fields are public. Keep private data in separate documents or collections.
Does it validate existing application queries?
It can identify and account for query patterns found in the codebase, but you must test them with Firebase tooling.
Can it implement roles?
Yes. It can draft ownership and role-based policies while protecting role fields from self-escalation.
Does it deploy the rules?
It can prepare rules and recommend validation commands. You control deployment and must review the changes first.