Skills firebase-development-debug
📦
firebase-development-debug
Content revision r1 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access
Debug Firebase Development Failures
Firebase failures often span emulators, rules, auth, functions, and deployment settings. This skill provides a structured workflow that narrows the cause and verifies the fix.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "firebase-development-debug" from https://skillstore.io/skills/2389-research-firebase-development-debug.md and its manifest at https://skillstore.io/api/skills/2389-research-firebase-development-debug/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "firebase-development-debug". My emulators fail to start because a port is already in use.
Expected outcome:
- Classify the issue as an emulator startup problem.
- Identify which Firebase port is occupied and which process owns it.
- Confirm the process before stopping it, then restart the emulator suite.
- Record the port conflict and prevention step in the debugging notes.
Using "firebase-development-debug". A Firestore write returns a permission denied error in local development.
Expected outcome:
- Classify the issue as a rules violation.
- Reproduce the write in the Rules Playground with the same auth context.
- Compare the request data and document path with the rule condition.
- Update the rule or request shape, then rerun the same simulation.
Using "firebase-development-debug". My function returns an internal error after deployment.
Expected outcome:
- Classify the issue as a function or deployment problem.
- Collect the exact error, runtime logs, and recent configuration changes.
- Add focused logging around function entry, auth context, inputs, and caught errors.
- Run the build step locally before testing a redeploy.
Security Audit
High Riskv6 • 7/4/2026 Open versioned report
Most static command findings are Markdown examples or references for Firebase debugging. The real security concern is direct guidance to read .env files, which can expose credentials to the agent or logs.
1
Files scanned
183
Lines analyzed
7
Review items
0
False positives ignored
Confirmed security concerns (3)
High
Environment file access
cat functions/.env
The skill explicitly instructs cat functions/.env. Environment files often contain credentials, so this is a real secret exposure risk.
High
Environment file access
cat hosting/.env.local # Should have NEXT_PUBLIC_USE_EMULATORS=true
The skill explicitly instructs cat hosting/.env.local. Even public-prefixed variables should be reviewed selectively instead of dumping the file.
High
Environment variant files
cat hosting/.env.local # Should have NEXT_PUBLIC_USE_EMULATORS=true
The .env.local variant is a known local secret file pattern. Reading it directly creates a credible credential disclosure risk.
Capability review items (7)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Ruby/shell backtick execution
```bash
The fenced commands instruct reading .env files. Those files commonly contain credentials, so displaying them to an agent can expose secrets.
High
Hidden file access
cat functions/.env
The instruction reads functions/.env directly. Hidden environment files commonly hold secrets and should not be displayed wholesale to an agent.
High
Hidden file access
cat hosting/.env.local # Should have NEXT_PUBLIC_USE_EMULATORS=true
The instruction reads hosting/.env.local directly. Local environment files may include API keys or service endpoints that should be redacted.
Medium
Ruby/shell backtick execution
```bash
The fenced command block includes port inspection and kill -9 guidance. It is legitimate troubleshooting, but an incorrect PID can terminate unrelated local processes.
Medium
Ruby/shell backtick execution
```bash
The fenced block asks the agent to read deployment config and run Firebase CLI inspection. This is legitimate debugging but can reveal project metadata.
Medium
Ruby/shell backtick execution
```bash
The npm run build instruction executes project-defined scripts. This is common development work, but it can run arbitrary local build hooks.
Medium
Ruby/shell backtick execution
| Port conflicts | `lsof -i :<port>`, kill process |
The quick reference repeats lsof and process-kill guidance. It is useful for port conflicts but can terminate the wrong process if followed carelessly.
Risk Factors
⚙️ External commands (31)
SKILL.md:28 SKILL.md:29 SKILL.md:30 SKILL.md:55-58 SKILL.md:58-60 SKILL.md:60-62 SKILL.md:62-66 SKILL.md:66-68 SKILL.md:68-85 SKILL.md:85-98 SKILL.md:98-103 SKILL.md:103-106 SKILL.md:106-110 SKILL.md:110-114 SKILL.md:114-119 SKILL.md:119-122 SKILL.md:122-124 SKILL.md:124-129 SKILL.md:129-133 SKILL.md:133-135 SKILL.md:135-140 SKILL.md:140-142 SKILL.md:142-151 SKILL.md:151-161 SKILL.md:161-166 SKILL.md:166-167 SKILL.md:167-172 SKILL.md:172-179 SKILL.md:179-180 SKILL.md:180-181 SKILL.md:181-182
🌐 Network access (2)
📁 Filesystem access (2)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/2389-research-firebase-development-debug/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/2389-research-firebase-development-debug?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/2389-research-firebase-development-debug?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/2389-research-firebase-development-debug/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/2389-research-firebase-development-debug.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
2389-research. (2026). firebase-development-debug security audit report (audit version 6) [Author version unspecified]. Skillstore. https://skillstore.io/skills/2389-research-firebase-development-debug/audits/6BibTeX citation
@techreport{2389-research-2389-research-firebase-development-debug-2026,
author = {2389-research},
title = {firebase-development-debug security audit report (audit version 6)},
institution = {Skillstore},
year = {2026},
number = {6},
url = {https://skillstore.io/skills/2389-research-firebase-development-debug/audits/6},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "firebase-development-debug security audit report (audit version 6)"
version: "unspecified"
type: report
authors:
- name: "2389-research"
date-released: "2026-07-04"
url: "https://skillstore.io/skills/2389-research-firebase-development-debug/audits/6"
identifiers:
- type: other
value: "skillstore:2389-research-firebase-development-debug:audit:6"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
70
Community
83
Spec Compliance
What You Can Build
Resolve Emulator Startup Problems
Identify port conflicts, inspect emulator startup output, and restart services with saved local state.
Diagnose Firestore Rule Denials
Reproduce permission failures in the Rules Playground and compare auth context with expected access rules.
Investigate Deployment Failures
Review Firebase debug logs, project configuration, targets, and predeploy build behavior before retrying deployment.
Try These Prompts
Classify My Firebase Error
Help me classify this Firebase problem. Ask for the error text, the affected service, and the last action I took.
Debug Emulator Startup
Walk me through debugging a Firebase emulator startup failure. Include checks for ports, logs, and safe restart steps.
Trace a Rules Denial
Help me debug a Firebase rules denial. Use the requested operation, document path, auth claims, and write data to find the mismatch.
Build a Full Debug Plan
Create a full Firebase debug plan for this failure. Separate likely causes, evidence to collect, tests to run, and fix verification steps.
Best Practices
- Start by classifying the failure before changing code or configuration.
- Preserve emulator state before restart when data helps reproduce the issue.
- Redact environment values and credentials before sharing diagnostic output.
Avoid
- Restarting every service before capturing the original error and logs.
- Sharing full environment files when only variable names are needed.
- Treating Admin SDK behavior as proof that client security rules allow access.
Frequently Asked Questions
Does this skill fix Firebase issues automatically?
No. It guides diagnosis, suggests checks, and helps verify fixes after you approve changes.
Can it help with Firestore permission denied errors?
Yes. It focuses on the operation, document path, auth context, request data, and rule evaluation trace.
Does it require the Firebase Emulator UI?
The workflow recommends it for local debugging, but logs and terminal output can still provide useful evidence.
Can I use it for production outages?
It is designed for development debugging. Production incidents need monitoring, rollback plans, and incident procedures.
Will it read my environment files?
It may ask for configuration evidence. You should share only needed variable names and redact secret values.
Does it support Cloud Functions debugging?
Yes. It suggests targeted logging, input checks, auth context review, and local build verification.
Developer Details
Author
2389-researchLicense
MIT
Skillstore revision
r1
Version notice
The author did not declare a version.
Repository
https://github.com/2389-research/claude-plugins/tree/main/firebase-development/skills/debugRef
14dc8f201a64f8d30fd131d7f036cd5e788be523
Maintenance freshness
7/18/2026
Usage
13 downloads · 200 views
File structure
📄 SKILL.md