Skills firebase-basics
๐Ÿ“ฆ

firebase-basics

Content revision r1 High Risk ๐Ÿ“ Filesystem access๐ŸŒ Network accessโš™๏ธ External commands๐Ÿ”‘ Env variables

Set Up Firebase Projects with AI Agents

Firebase setup often requires CLI, authentication, and project context checks. This skill guides Claude, Codex, and Claude Code through Firebase setup workflows.

Supports: Claude Codex Code(CC)
โš ๏ธ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "firebase-basics" from https://skillstore.io/skills/firebase-firebase-basics.md and its manifest at https://skillstore.io/api/skills/firebase-firebase-basics/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Test it

Using "firebase-basics". Check whether my machine is ready for Firebase development.

Expected outcome:

  • Node.js version is verified or installation guidance is provided.
  • Firebase CLI availability is checked through the recommended workflow.
  • Authentication status and active project context are reviewed with user confirmation.

Using "firebase-basics". Help me connect Cursor to Firebase MCP.

Expected outcome:

  • The expected Cursor MCP configuration location is identified.
  • Existing Firebase MCP settings are checked before any edit is proposed.
  • A restart and connection verification step is included.

Using "firebase-basics". Add Firebase to my web app.

Expected outcome:

  • The workflow covers project and web app registration.
  • SDK installation and app initialization steps are outlined.
  • Service imports are added only for the Firebase products the app uses.

Security Audit

High Risk
v4 โ€ข 7/6/2026 Open versioned report

Most static filesystem, network, environment, and reconnaissance alerts are false positives from setup documentation, placeholders, and Markdown formatting. Several Firebase CLI instructions are confirmed as medium-risk because they run npx-based tooling, authenticate users, or alter project context. The main semantic concern is forceful agent-control wording that may override normal user intent.

16
Files scanned
691
Lines analyzed
6
Review items
0
False positives ignored

Confirmed security concerns (1)

High
Prompt Injection Attempt Detected
The skill uses forceful agent-control language such as "ALWAYS use this skill" and "Do NOT proceed". These directives can override normal user intent and task prioritization.
The cited lines contain explicit always-use and do-not-proceed agent directives. They do not target the auditor, but they can constrain agent behavior beyond a normal reference guide.
Capability review items (6)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
Ruby/shell backtick execution
- Run `npx -y firebase-tools@latest --version` to check if the Firebase CLI is installed.
The line instructs the agent to execute an npx command from the latest firebase-tools package. This is expected for the skill, but it runs external package code in the user environment.
Medium
Ruby/shell backtick execution
Ensure you are logged in to Firebase so that commands have the correct permissions. Run `npx -y fire
The line instructs Firebase CLI login, which can create authenticated local credentials and open an interactive auth flow. This is legitimate but security-sensitive.
Medium
Ruby/shell backtick execution
Most Firebase tasks require an active project context. Check the current project by running `npx -y
The line directs the agent to run Firebase CLI through npx to inspect active project context. It is scoped, but it still executes external tooling locally.
Medium
Ruby/shell backtick execution
```bash
The referenced code block contains a Firebase CLI command that can change the active project alias. This is expected workflow behavior but has project-state side effects.
Medium
Ruby/shell backtick execution
```
The referenced span includes the command-usage policy that tells agents to use npx for Firebase CLI commands. The markdown match is noisy, but the surrounding instruction still normalizes local command execution.
Medium
Ruby/shell backtick execution
1. **Use npx for CLI commands:** To ensure you always use the latest version of the Firebase CLI, al
The line explicitly instructs agents to always run Firebase CLI through npx with the latest package. This is useful but carries external package execution and supply-chain risk.
Audited by: codex View Audit History โ†’
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/firebase-firebase-basics/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/firebase-firebase-basics/security.svg)](https://skillstore.io/skills/firebase-firebase-basics?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/firebase-firebase-basics?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/firebase-firebase-basics/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/firebase-firebase-basics.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA ยท BibTeX ยท CFF)

APA citation

firebase. (2026). firebase-basics security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/firebase-firebase-basics/audits/4

BibTeX citation

@techreport{firebase-firebase-firebase-basics-2026, author = {firebase}, title = {firebase-basics security audit report (audit version 4)}, institution = {Skillstore}, year = {2026}, number = {4}, url = {https://skillstore.io/skills/firebase-firebase-basics/audits/4}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "firebase-basics security audit report (audit version 4)" version: "unspecified" type: report authors: - name: "firebase" date-released: "2026-07-06" url: "https://skillstore.io/skills/firebase-firebase-basics/audits/4" identifiers: - type: other value: "skillstore:firebase-firebase-basics:audit:4" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High
45
Architecture
85
Maintainability
87
Content
68
Community
83
Spec Compliance

What You Can Build

Prepare a New Firebase Workspace

Verify Node.js, install Firebase CLI access, sign in, and select the correct active project before development begins.

Connect an Agent to Firebase MCP

Add or verify Firebase MCP configuration for tools such as Claude Code, Cursor, Gemini CLI, GitHub Copilot, and Antigravity.

Start Firebase Services in an App

Use Firebase CLI guidance to create projects, initialize services, and add Firebase web SDK setup to an application.

Try These Prompts

Check My Firebase Setup
Use the firebase-basics skill to check whether my local environment is ready for Firebase development. Ask before running commands.
Select the Right Project
Use the firebase-basics workflow to verify my active Firebase project and help me set the correct project alias.
Configure Firebase MCP
Use firebase-basics to review my agent environment and propose Firebase MCP setup steps. Show any configuration changes before applying them.
Initialize Firebase for a Web App
Use firebase-basics to create a Firebase setup plan for this web app, including project creation, service initialization, SDK setup, and verification.

Best Practices

  • Confirm the active Firebase project before running setup or deployment commands.
  • Ask the user before authentication, global installs, or persistent configuration changes.
  • Use official Firebase CLI help and Firebase knowledge sources when commands or workflows are unclear.

Avoid

  • Do not run Firebase CLI commands against an unknown active project.
  • Do not overwrite existing MCP server configuration entries.
  • Do not treat placeholder Firebase web config values as production-ready settings.

Frequently Asked Questions

What does this skill help with?
It helps agents prepare Firebase CLI access, choose a project, configure MCP, and start web SDK setup.
Does it support Claude, Codex, and Claude Code?
Yes. The report marks compatibility with Claude, Codex, and Claude Code.
Can it create Firebase projects?
It provides Firebase CLI guidance for project creation, but the authenticated user must have the required permissions.
Does it configure MCP automatically?
It documents MCP configuration steps. Users should review and approve any persistent config changes.
Is a Firebase web API key a secret?
Firebase web API keys are client configuration values. Service account keys and private credentials must still be protected.
What should users verify before deployment?
Users should verify authentication, active project, initialized services, billing needs, and Firebase security rules.

Developer Details

Author

firebase

License

MIT

Skillstore revision

r1

Version notice

The author did not declare a version.

Ref

a06681402992ceae98ba04d54cfd4ab004862696

Maintenance freshness

7/18/2026

Usage

2 downloads ยท 90 views

More from firebase

View all
View all