Versioned security assessment

Report ID: SA-CAA6A273

6/30/2026, 12:53:11 AM

firebase-firestore security assessment v2

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
firebase-firestore
Version
v2
Maintainer
firebase
Source
github.com/firebase/agent-skills/tree/main/skills/firebase-firestore/
Coverage
17 Files scanned · 3,190 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Low

2 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Static analysis found many command, network, and credential patterns. Manual review shows most are markdown examples for Firebase SDKs, Firestore rules, and security testing, but the skill does instruct agents to run Firebase CLI commands through npx and deploy or create Firestore resources. No prompt injection or confirmed malicious exfiltration was found; publish with a warning about external commands and cloud mutations.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

17 Files scanned · 3,190 Lines analyzed

5 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 4 evidence locations

Filesystem access

May read or write local files.

Observed in 4 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 4 evidence locations

Capability review items (3)
Medium
SKILL.md:9SKILL.md:19-20references/standard/provisioning.md:81-90
External Firebase CLI Execution
The skill tells agents to run Firebase CLI commands with npx and firebase-tools@latest. This is legitimate Firestore management, but it can download executable code, use credentials, and act on a Firebase project.
The command strings are explicit and are part of the intended workflow. The risk is operational rather than malicious because the commands target Firebase administration.
Medium
SKILL.md:41-42references/enterprise/provisioning.md:24-30references/standard/provisioning.md:81-90
Cloud Resource Mutation Commands
The skill includes commands that create Firestore databases and deploy rules or indexes. These operations can change live cloud resources if run against a real project.
The cited lines directly show create and deploy workflows. They are expected for the skill, but they require explicit user approval and project verification.
Medium
references/standard/provisioning.md:15-23references/standard/provisioning.md:47-75references/enterprise/provisioning.md:48-60
Local Firebase Configuration Writes
The provisioning guides direct agents to create or update firebase.json, firestore.rules, and firestore.indexes.json. Incorrect edits could weaken rules or disrupt deployment configuration.
The file-write instructions are explicit. This is a normal setup capability, but mistakes can affect application security and deployment behavior.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (2)

RISK-001 Low
references/standard/security_rules.md:420-435references/enterprise/security_rules.md:420-435
Dismissed Shell Command Substitution Matches
The scanner flagged $() syntax in Firestore Rules path interpolation. The reviewed lines are fenced documentation examples, not host shell execution.
The syntax appears inside Firestore Rules examples that use /databases/$(database)/documents paths. This is not shell command substitution.
RISK-002 Low
references/standard/security_rules.md:515-518references/enterprise/security_rules.md:515-518
Dismissed Credential Keyword Matches
The scanner flagged private-key wording in a defensive checklist. The text asks users to test for data exposure and does not include secrets or exfiltration logic.
The context is an attack checklist for hardening Firestore rules. No actual key, certificate, seed phrase, or outbound transfer is present.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (1)
Low
references/standard/indexes.md:46-60references/enterprise/indexes.md:22-23references/standard/flutter_setup.md:82-89
Dismissed Weak Crypto Matches
The weak-cryptography alerts map to Firestore query and index examples, not cryptographic algorithms. No reviewed file implements hashing, encryption, or key derivation.
The cited content is about Firestore query operators, field ordering, and SDK calls. The static labels do not match the semantic context.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable