Skills firebase-development-validate
📦
firebase-development-validate
Content revision r1 Safe ⚙️ External commands
Validate Firebase Security and Readiness
Firebase projects can ship with weak rules, missing tests, or unsafe deployment settings. This skill guides a structured review of configuration, authentication, functions, and release readiness.
Supports: Claude Codex Code(CC)
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "firebase-development-validate" from https://skillstore.io/skills/2389-research-firebase-development-validate.md and its manifest at https://skillstore.io/api/skills/2389-research-firebase-development-validate/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "firebase-development-validate". Review this Firebase project before launch.
Expected outcome:
- Critical: Firestore rules do not include a default deny rule.
- Important: Emulator tests are missing for the main write workflows.
- Nice-to-have: Document the selected functions architecture in the project README.
Using "firebase-development-validate". Check our authentication and API key handling.
Expected outcome:
- Authentication checks are present in callable functions.
- API key status validation should confirm active keys before attaching user identity.
- Add tests for invalid, inactive, and missing credentials.
Using "firebase-development-validate". Validate production readiness for this Firebase app.
Expected outcome:
- Build and test commands should pass in the local project environment.
- Secrets should be excluded from source control and documented for deployment.
- Indexes should cover complex Firestore queries before launch.
Security Audit
Safev6 • 7/6/2026 Open versioned report
The static findings are false positives caused by Markdown inline code and fenced examples in SKILL.md. I found no prompt injection, credential exfiltration, destructive command intent, or executable code in the skill file.
1
Files scanned
199
Lines analyzed
0
Review items
0
False positives ignored
Risk Factors
⚙️ External commands (52)
SKILL.md:26 SKILL.md:27 SKILL.md:28 SKILL.md:37 SKILL.md:38 SKILL.md:39 SKILL.md:40 SKILL.md:44 SKILL.md:49-56 SKILL.md:56-60 SKILL.md:60-65 SKILL.md:65 SKILL.md:67-68 SKILL.md:68-71 SKILL.md:71-76 SKILL.md:76 SKILL.md:77-82 SKILL.md:82-88 SKILL.md:88-89 SKILL.md:89-90 SKILL.md:90-93 SKILL.md:93-97 SKILL.md:97-101 SKILL.md:101-102 SKILL.md:102-105 SKILL.md:105-107 SKILL.md:107-109 SKILL.md:109-114 SKILL.md:114-115 SKILL.md:115-116 SKILL.md:116 SKILL.md:119-121 SKILL.md:121-127 SKILL.md:127-129 SKILL.md:129-135 SKILL.md:135-136 SKILL.md:136 SKILL.md:137-141 SKILL.md:141-142 SKILL.md:142-143 SKILL.md:143-144 SKILL.md:144-162 SKILL.md:162-163 SKILL.md:163-171 SKILL.md:171-172 SKILL.md:172-176 SKILL.md:176-182 SKILL.md:182-194 SKILL.md:194-195 SKILL.md:195-196 SKILL.md:196-197 SKILL.md:197-198
No confirmed security findings were detected by the latest completed static and semantic audit. This does not prove the skill has no side effects.
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/2389-research-firebase-development-validate/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/2389-research-firebase-development-validate?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/2389-research-firebase-development-validate?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/2389-research-firebase-development-validate/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/2389-research-firebase-development-validate.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
2389-research. (2026). firebase-development-validate security audit report (audit version 6) [Author version unspecified]. Skillstore. https://skillstore.io/skills/2389-research-firebase-development-validate/audits/6BibTeX citation
@techreport{2389-research-2389-research-firebase-development-validate-2026,
author = {2389-research},
title = {firebase-development-validate security audit report (audit version 6)},
institution = {Skillstore},
year = {2026},
number = {6},
url = {https://skillstore.io/skills/2389-research-firebase-development-validate/audits/6},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "firebase-development-validate security audit report (audit version 6)"
version: "unspecified"
type: report
authors:
- name: "2389-research"
date-released: "2026-07-06"
url: "https://skillstore.io/skills/2389-research-firebase-development-validate/audits/6"
identifiers:
- type: other
value: "skillstore:2389-research-firebase-development-validate:audit:6"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: High 55
Architecture
85
Maintainability
87
Content
70
Community
83
Spec Compliance
What You Can Build
Pre-release Firebase review
Validate rules, functions, tests, and deployment settings before a production launch.
Security rules audit
Check Firestore access rules for ownership checks, field validation, and default deny coverage.
Architecture consistency check
Review Cloud Functions organization, authentication flow, and shared patterns across a team project.
Try These Prompts
Review a Firebase project
Review this Firebase project for security, configuration, tests, and production readiness. Summarize critical, important, and nice-to-have findings.
Audit Firestore rules
Audit the Firestore rules in this project. Check authentication, ownership, field validation, collection group coverage, and default deny behavior.
Check functions architecture
Review the Cloud Functions implementation. Identify the architecture pattern, authentication approach, error handling, response format, and test gaps.
Prepare for production launch
Perform a production readiness audit for this Firebase application. Include configuration, rules, authentication, tests, secrets handling, build status, and remediation priorities.
Best Practices
- Run the review against the same architecture pattern the project intends to use.
- Review Firestore rules with representative user roles and write scenarios.
- Confirm risky command checks with the user before running local project scripts.
Avoid
- Do not mix Express, domain-grouped, and individual function patterns without a migration plan.
- Do not accept broad Firestore write access without field-level validation.
- Do not treat passing builds as proof that security rules are correct.
Frequently Asked Questions
Does this skill change my Firebase project?
No. It guides review and recommends fixes. Any edits require a separate user request.
Can it review Firestore security rules?
Yes. It checks authentication, ownership, allowed field changes, collection group rules, and default deny coverage.
Does it run Firebase deployments?
No. It is intended for validation before deployment, not for deploying resources.
Can it check Cloud Functions structure?
Yes. It reviews architecture pattern, exports, shared code, authentication, error handling, and response consistency.
Should commands be run automatically?
No. Local commands should be confirmed with the user, especially test and build scripts from a project repository.
Is this a full security assessment?
No. It is a structured Firebase code review aid and should be combined with manual testing for high-risk applications.
Developer Details
Author
2389-researchLicense
MIT
Skillstore revision
r1
Version notice
The author did not declare a version.
Repository
https://github.com/2389-research/claude-plugins/tree/main/firebase-development/skills/validateRef
c1fdca50ff516318f65fed0d7f9e82797c5171dc
Maintenance freshness
7/18/2026
Usage
6 downloads · 222 views
File structure
📄 SKILL.md