Навыки firestore-rules-creation
📦
firestore-rules-creation
Ревизия содержимого r1 Высокий риск ⚙️ Внешние команды🌐 Доступ к сети
Create Secure Firestore Rules
Firestore Rules can expose private data when access and validation logic are incomplete. This skill helps create structured rules with least-privilege access, schema checks, and security test scenarios.
Поддерживает: Claude Codex Code(CC)
Остановитесь и запросите подтверждение перед установкой.
Проверьте план и получите явное согласие пользователя перед изменением файлов.
Установить с помощью моего Агента
Скопируйте этот запрос в своего Агента. Он содержит каноническую страницу Skill и манифест.
Запрос агента
Review the Skillstore skill "firestore-rules-creation" from https://skillstore.io/skills/firebase-firestore-rules-creation.md and its manifest at https://skillstore.io/api/skills/firebase-firestore-rules-creation/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Ваш Агент по-прежнему должен показать план и запросить все подтверждения, требуемые политикой безопасности.
Ресурсы для AI-агентов
Используйте эти ссылки, когда AI-агенту, crawler или script нужен чистый контекст вместо полной страницы.
Протестировать
Использование «firestore-rules-creation». Create rules for private user profiles and public posts.
Ожидаемый результат:
- Assumed data model for profiles and posts.
- Rules that limit profile access to the owner.
- Rules that allow public post reads without exposing profile PII.
- A list of assumptions and tests to run.
Использование «firestore-rules-creation». Secure a likes counter on each post.
Ожидаемый результат:
- A counter-update policy that limits changed fields.
- A consistency check for one like per user.
- A replay and batch-operation test checklist.
Аудит безопасности
Высокий рискv1 • 11.09.2026 Открыть версионный отчет
Static detections are false positives caused by Markdown code formatting, Firestore Rules interpolation syntax, and security-focused prose. No command execution, network access, reconnaissance, or credential exposure is present. One semantic issue remains: the guidance to prefer `read` can unintentionally grant both get and list access.
1
Просканировано файлов
585
Проанализировано строк
0
Пункты проверки
0
Ложные срабатывания проигнорированы
Подтверждённые проблемы безопасности (1)
Высокий
Overbroad Read Permission Guidance
The instruction to prefer `read` over `list` or `get` can overgrant access because Firestore `read` covers both single-document reads and queries. Rules should distinguish `get` and `list` when their authorization requirements differ.
The guidance explicitly prefers the broader Firestore read operation without limiting it to cases where get and list have identical authorization requirements.
Факторы риска
⚙️ Внешние команды (50)
SKILL.md:32 SKILL.md:33 SKILL.md:59 SKILL.md:60 SKILL.md:79-96 SKILL.md:96-100 SKILL.md:100-225 SKILL.md:225-266 SKILL.md:266-273 SKILL.md:273-277 SKILL.md:277-284 SKILL.md:284-288 SKILL.md:288 SKILL.md:289-293 SKILL.md:293-296 SKILL.md:296-299 SKILL.md:299-300 SKILL.md:300-302 SKILL.md:302 SKILL.md:303-304 SKILL.md:304-307 SKILL.md:307 SKILL.md:312 SKILL.md:315-320 SKILL.md:320-334 SKILL.md:334-337 SKILL.md:337-338 SKILL.md:338-343 SKILL.md:343-346 SKILL.md:346-349 SKILL.md:349-352 SKILL.md:352-355 SKILL.md:355-356 SKILL.md:356 SKILL.md:357 SKILL.md:358-375 SKILL.md:375-383 SKILL.md:383-387 SKILL.md:387-393 SKILL.md:393-404 SKILL.md:404-414 SKILL.md:414-417 SKILL.md:417-421 SKILL.md:421 SKILL.md:424 SKILL.md:429-430 SKILL.md:430-435 SKILL.md:435-455 SKILL.md:455-468 SKILL.md:468-469
🌐 Доступ к сети (1)
Аудитор:: claude
Поделиться и цитировать этот отчет
Делитесь версионным отчетом об оценке, нейтральным значком, встраиваемой карточкой и цитатами. Skillstore публикует доказательства, не решая, безопасен ли этот Skill.
Копировать ссылку на отчёт
https://skillstore.io/skills/firebase-firestore-rules-creation/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportЗначок Markdown
[](https://skillstore.io/skills/firebase-firestore-rules-creation?utm_source=security_passport_badge)Значок HTML
<a href="https://skillstore.io/skills/firebase-firestore-rules-creation?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/firebase-firestore-rules-creation/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Встраиваемая карточка
<iframe src="https://skillstore.io/embed/skills/firebase-firestore-rules-creation.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Академические ссылки (APA · BibTeX · CFF)
Цитата APA
firebase. (2026). firestore-rules-creation security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/firebase-firestore-rules-creation/audits/1Цитата BibTeX
@techreport{firebase-firebase-firestore-rules-creation-2026,
author = {firebase},
title = {firestore-rules-creation security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/firebase-firestore-rules-creation/audits/1},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "firestore-rules-creation security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
- name: "firebase"
date-released: "2026-09-11"
url: "https://skillstore.io/skills/firebase-firestore-rules-creation/audits/1"
identifiers:
- type: other
value: "skillstore:firebase-firestore-rules-creation:audit:1"
description: "Skillstore immutable audit report identifier"
Оценка Skillstore
Почему такая оценка Достоверность доказательств: Средний 55
Архитектура
85
Сопровождаемость
87
Контент
65
Сообщество
87
Соответствие спецификации
Что вы можете построить
Build a new application policy
Create a starting rules file for a new Firestore application with authenticated ownership and schema validation.
Protect collaborative data
Define safe editor, viewer, owner, and administrator permissions for shared documents.
Harden an existing rules file
Refactor existing rules and test for update bypasses, role escalation, data leakage, and unsafe counters.
Попробуйте эти промпты
Start a rules file
Review this project and create a prototype firestore.rules file. List your data model assumptions and require authentication by default.
Add document ownership
Create Firestore Rules for a posts collection. Authors can create, read, update, and delete only their own posts. Validate title, body, author ID, and timestamps.
Model role-based access
Design Firestore Rules for a workspace application with owners, editors, and viewers. Keep role fields immutable for non-owners and validate every update.
Test complex business logic
Refactor these Firestore Rules and perform the full attack checklist. Check counters, state transitions, collection queries, PII separation, and batch consistency.
Лучшие практики
- Provide real collection paths, field types, queries, and user roles before generating rules.
- Test rules in the Firebase Emulator Suite with allowed and denied requests.
- Review generated rules before deployment and repeat tests after each schema change.
Избегать
- Do not use generated rules unchanged when application requirements are uncertain.
- Do not store public profile data and private personal data in the same document.
- Do not grant broad read or write access merely to resolve permission errors.
Часто задаваемые вопросы
What does this skill create?
It creates or refines a prototype Firestore Rules file and documents assumptions, validation, and test scenarios.
Does it make Firestore Rules secure by itself?
No. You must review the rules against your application behavior and test them before production use.
Can it support public data?
Yes. Describe which collections and fields are public. Keep private data in separate documents or collections.
Does it validate existing application queries?
It can identify and account for query patterns found in the codebase, but you must test them with Firebase tooling.
Can it implement roles?
Yes. It can draft ownership and role-based policies while protecting role fields from self-escalation.
Does it deploy the rules?
It can prepare rules and recommend validation commands. You control deployment and must review the changes first.