# Audit Firebase Security Rules

Firestore rules can accidentally allow data leaks, role escalation, or unsafe updates. This skill guides Claude, Codex, and Claude Code through a focused review of access control and validation gaps.

## Install

```bash
npx skillstore add firebase/firebase-security-rules-auditor
```

## Metadata

- Status: approved
- Slug: firebase-firebase-security-rules-auditor
- Skillstore revision: r1
- Version status: missing
- Tree hash: 6be14697218f0b61fb47f0d01ce0bbfbc8746bc8fc9f4d555d27e81125648f67
- Author: firebase
- GitHub username: firebase
- License: MIT
- Repository: https://github.com/firebase/agent-skills/tree/main/skills/firebase-security-rules-auditor/
- Ref: a06681402992ceae98ba04d54cfd4ab004862696
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands
- Quality score: 77
- Quality tier: bronze
- Public page: https://skillstore.pages.dev/skills/firebase-firebase-security-rules-auditor
- Manifest: https://skillstore.pages.dev/api/skills/firebase-firebase-security-rules-auditor/manifest

## Capabilities

- Reviews create and update rule differences for update bypass risk.
- Checks whether sensitive authority fields rely on user-supplied document data.
- Evaluates ownership checks around hasOnly\(\) and diff\(\) field restrictions.
- Identifies missing type checks, string limits, and array size limits.
- Scores rule sets from critical to secure with remediation guidance.
- Considers hardcoded admin email bootstrapping when email verification is required.

## Use Cases

- Pre-Release Rules Review: Check new Firestore rules before deployment and identify authorization or validation gaps.
- Security Triage: Prioritize rule weaknesses by severity and convert them into concrete remediation tasks.
- Product Logic Validation: Verify that rules support collaboration, ownership, and admin workflows without unsafe shortcuts.

## Prompt Templates

### Basic Rules Review

```
Audit these Firestore security rules. Summarize the main risks, assign a 1 to 5 score, and list practical fixes.
```

### Update Bypass Check

```
Review these rules for update bypasses. Compare create and update validation for roles, ownership fields, sizes, and data types.
```

### Ownership and Role Review

```
Audit whether these rules trust user-provided authority fields. Check ownerId, role, isAdmin, and collaborator access paths.
```

### Release Gate Assessment

```
Perform a release-gate audit for these Firestore rules. Include severity, exploit scenario, affected workflow, and recommended rule changes.
```

## Limitations

- Focuses on Firestore security rules, not Firebase Storage rules unless provided.
- Does not run Firebase emulators or prove exploits with live requests.
- Requires current rules and app context for accurate business-logic review.
- Cannot replace a full application penetration test or production monitoring.

## Best Practices

- Provide complete rules, collection purpose, and expected user roles before asking for review.
- Ask for separate findings for data leaks, privilege escalation, validation bypass, and denial-of-service risk.
- Use the recommendations to update rules, then run a second audit on the revised version.

## Anti Patterns

- Do not audit isolated snippets without explaining the app workflow and user roles.
- Do not treat hasOnly\(\) or diff\(\) as ownership checks by themselves.
- Do not accept a high score when update rules skip validation used during create.

## Security Audit

- Audited at: 2026-07-06T14:47:25.173\+00:00
- Summary: Static analysis flagged Markdown backticks and security-audit wording in SKILL.md. Manual review found these are non-executable Firestore rule references and legitimate audit checklist items, with no prompt injection or malicious intent found.

## Stats

- Views: 23
- Downloads: 6
- Favorites: 0
- Popularity score: 0