Audit Firebase Security Rules
Firestore rules can accidentally allow data leaks, role escalation, or unsafe updates. This skill guides Claude, Codex, and Claude Code through a focused review of access control and validation gaps.
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Review the Skillstore skill "firebase-security-rules-auditor" from https://skillstore.io/skills/firebase-firebase-security-rules-auditor.md and its manifest at https://skillstore.io/api/skills/firebase-firebase-security-rules-auditor/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Your Agent should still show its plan and request any confirmation required by the security policy.
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Using "firebase-security-rules-auditor". A rule lets authenticated users update profile display names with hasOnly() but has no ownership check.
Expected outcome:
Major finding: field restrictions limit what changes, but not who can change another profile. Add an ownership check before allowing updates.
Using "firebase-security-rules-auditor". A create rule validates field types, but the update rule allows any new data for the same document.
Expected outcome:
Critical finding: the update path can bypass create validation. Reuse the same type, size, and allowed-field checks for updates.
Using "firebase-security-rules-auditor". An admin rule checks a fixed email and also requires email_verified to be true.
Expected outcome:
Minor or no issue: this limited bootstrap pattern can be acceptable when no rule lets users add new admins or bypass verification.
Static analysis flagged Markdown backticks and security-audit wording in SKILL.md. Manual review found these are non-executable Firestore rule references and legitimate audit checklist items, with no prompt injection or malicious intent found.
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
https://skillstore.io/skills/firebase-firebase-security-rules-auditor/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report[](https://skillstore.io/skills/firebase-firebase-security-rules-auditor?utm_source=security_passport_badge)<a href="https://skillstore.io/skills/firebase-firebase-security-rules-auditor?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/firebase-firebase-security-rules-auditor/security.svg" alt="Skillstore security assessment" loading="lazy"></a><iframe src="https://skillstore.io/embed/skills/firebase-firebase-security-rules-auditor.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>firebase. (2026). firebase-security-rules-auditor security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/firebase-firebase-security-rules-auditor/audits/4@techreport{firebase-firebase-firebase-security-rules-auditor-2026,
author = {firebase},
title = {firebase-security-rules-auditor security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/firebase-firebase-security-rules-auditor/audits/4},
note = {Author version unspecified}
}cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "firebase-security-rules-auditor security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
- name: "firebase"
date-released: "2026-07-06"
url: "https://skillstore.io/skills/firebase-firebase-security-rules-auditor/audits/4"
identifiers:
- type: other
value: "skillstore:firebase-firebase-security-rules-auditor:audit:4"
description: "Skillstore immutable audit report identifier"
Check new Firestore rules before deployment and identify authorization or validation gaps.
Prioritize rule weaknesses by severity and convert them into concrete remediation tasks.
Verify that rules support collaboration, ownership, and admin workflows without unsafe shortcuts.
Audit these Firestore security rules. Summarize the main risks, assign a 1 to 5 score, and list practical fixes.
Review these rules for update bypasses. Compare create and update validation for roles, ownership fields, sizes, and data types.
Audit whether these rules trust user-provided authority fields. Check ownerId, role, isAdmin, and collaborator access paths.
Perform a release-gate audit for these Firestore rules. Include severity, exploit scenario, affected workflow, and recommended rule changes.
Author
firebaseLicense
MIT
Skillstore revision
r1
Version notice
The author did not declare a version.
Repository
https://github.com/firebase/agent-skills/tree/main/skills/firebase-security-rules-auditor/Ref
a06681402992ceae98ba04d54cfd4ab004862696
Maintenance freshness
7/18/2026
Usage
1 downloads · 23 views
File structure
📄 SKILL.md
Audit Firestore Security Rules
Firestore rules often miss update bypasses, ownership checks, and validation gaps. This skill guides Claude, Codex, or Claude Code through a focused security review.
Integrate Firebase AI Logic in Apps
Adding Gemini features to Firebase apps requires platform-specific setup and production safeguards. This skill provides focused Firebase AI Logic guidance for web, mobile, and Flutter projects.
Build Firestore Standard Apps Safely
Firestore setup can fail when rules, indexes, and SDK usage are planned separately. This skill helps Claude, Codex, and Claude Code create secure project files, validate access patterns, and guide Web SDK integration.
Integrate Firebase AI Logic
Developers often need Firebase AI features without maintaining a separate backend. This skill guides setup, Gemini model usage, multimodal prompts, structured output, and production security for web apps.
Build Genkit JS Apps
Genkit changes quickly, and outdated examples cause broken TypeScript flows. This skill guides setup, documentation lookup, examples, and troubleshooting for current Genkit JavaScript work.
Deploy Firebase Hosting Sites
Firebase Hosting setup can be confusing when choosing between classic Hosting, App Hosting, and deployment channels. This skill guides agents through configuration, local emulation, preview channels, and safe releases for static sites, SPAs, and simple services.
Test IDOR Access Control Safely
by sickn33
IDOR flaws expose user data when object references lack ownership checks. This skill guides authorized testers through controlled detection, proof collection, and remediation planning.
Validate Firebase Security and Readiness
by 2389-research
Firebase projects can ship with weak rules, missing tests, or unsafe deployment settings. This skill guides a structured review of configuration, authentication, functions, and release readiness.
Harden AWS IAM Access with Least Privilege
by sickn33
Overly broad IAM access increases cloud security risk and complicates audits. This skill provides focused checks, policy guidance, and hardening steps for AWS identities.
Review Cultural Data Practices
by Acurioustractor
Sensitive stories can be mishandled when consent, access, and ownership rules are unclear. This skill guides reviews using OCAP, sensitivity levels, and approval workflows.
Audit UniFi Security Policies
by DataKnifeAI
UniFi teams need clear reviews of zones, ACLs, and guest access. This skill guides Claude, Codex, and Claude Code through audits, policy checks, and compliance-ready summaries.
Review Application Security Before Release
by sickn33
Teams can miss common security defects before deployment. This skill provides a structured checklist for secrets, input validation, auth, and testing.