技能 firebase-basics

📦

firebase-basics

Name: firebase-basics
Author: firebase

內容修訂 r1 高風險 📁 檔案系統存取🌐 網路存取⚙️ 外部命令🔑 環境變數

使用 AI 代理設定 Firebase 專案

Firebase 設定通常需要 CLI、驗證和專案內容檢查。此技能會引導 Claude、Codex 和 Claude Code 完成 Firebase 設定工作流程。

支援: Claude Codex Code(CC)

⚠️ 38 差

Maintain this Skill? Claim it ⚠️ 38 差

安裝前請停止並請求確認。

請審查安裝計畫，並在變更檔案前取得使用者明確同意。

使用我的智慧代理安裝

將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。

智能體請求

Review the Skillstore skill "firebase-basics" from https://skillstore.io/skills/firebase-firebase-basics.md and its manifest at https://skillstore.io/api/skills/firebase-firebase-basics/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。

Agent 可讀資源

當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。

Markdown 詳情 GET /skills/firebase-firebase-basics.md 已簽名 manifest GET /api/skills/firebase-firebase-basics/manifest 已簽名 lockfile GET /api/skills/firebase-firebase-basics/lockfile

測試它

正在使用「firebase-basics」。檢查我的電腦是否已準備好進行 Firebase 開發。

預期結果:

已驗證 Node.js 版本，或提供安裝指引。
透過建議的工作流程檢查 Firebase CLI 可用性。
在使用者確認下檢閱驗證狀態和作用中專案內容。

正在使用「firebase-basics」。協助我將 Cursor 連接到 Firebase MCP。

預期結果:

識別預期的 Cursor MCP 設定位置。
在提出任何編輯前檢查現有 Firebase MCP 設定。
包含重新啟動和連線驗證步驟。

正在使用「firebase-basics」。將 Firebase 加入我的 Web 應用程式。

預期結果:

工作流程涵蓋專案和 Web 應用程式註冊。
概述 SDK 安裝和應用程式初始化步驟。
只為應用程式使用的 Firebase 產品加入服務匯入。

安全審計

高風險

v4 • 2026/7/6 開啟版本化報告

Most static filesystem, network, environment, and reconnaissance alerts are false positives from setup documentation, placeholders, and Markdown formatting. Several Firebase CLI instructions are confirmed as medium-risk because they run npx-based tooling, authenticate users, or alter project context. The main semantic concern is forceful agent-control wording that may override normal user intent.

已掃描檔案

691

分析行數

複核項目

已忽略的誤報

已確認的安全問題 (1)

高

SKILL.md:3 references/local-env-setup.md:65

Prompt Injection Attempt Detected

The skill uses forceful agent-control language such as "ALWAYS use this skill" and "Do NOT proceed". These directives can override normal user intent and task prioritization.

The cited lines contain explicit always-use and do-not-proceed agent directives. They do not target the auditor, but they can constrain agent behavior beyond a normal reference guide.

能力複核項目 (6)

這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。

中

SKILL.md:10

Ruby/shell backtick execution

- Run `npx -y firebase-tools@latest --version` to check if the Firebase CLI is installed.

The line instructs the agent to execute an npx command from the latest firebase-tools package. This is expected for the skill, but it runs external package code in the user environment.

中

SKILL.md:15

Ruby/shell backtick execution

Ensure you are logged in to Firebase so that commands have the correct permissions. Run `npx -y fire

The line instructs Firebase CLI login, which can create authenticated local credentials and open an interactive auth flow. This is legitimate but security-sensitive.

中

SKILL.md:20

Ruby/shell backtick execution

Most Firebase tasks require an active project context. Check the current project by running `npx -y

The line directs the agent to run Firebase CLI through npx to inspect active project context. It is scoped, but it still executes external tooling locally.

中

SKILL.md:24-26

Ruby/shell backtick execution

```bash

The referenced code block contains a Firebase CLI command that can change the active project alias. This is expected workflow behavior but has project-state side effects.

中

SKILL.md:26-33

Ruby/shell backtick execution

```

The referenced span includes the command-usage policy that tells agents to use npx for Firebase CLI commands. The markdown match is noisy, but the surrounding instruction still normalizes local command execution.

中

SKILL.md:33

Ruby/shell backtick execution

1. **Use npx for CLI commands:** To ensure you always use the latest version of the Firebase CLI, al

The line explicitly instructs agents to always run Firebase CLI through npx with the latest package. This is useful but carries external package execution and supply-chain risk.

審計單位: codex 檢視審計紀錄 →

分享與引用此報告

分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。

開啟版本化報告

複製報告連結

https://skillstore.io/skills/firebase-firebase-basics/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/firebase-firebase-basics/security.svg)](https://skillstore.io/skills/firebase-firebase-basics?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/firebase-firebase-basics?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/firebase-firebase-basics/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/firebase-firebase-basics.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

學術引用 (APA · BibTeX · CFF)

APA 引用

firebase. (2026). firebase-basics security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/firebase-firebase-basics/audits/4

BibTeX 引用

@techreport{firebase-firebase-firebase-basics-2026,
  author = {firebase},
  title = {firebase-basics security audit report (audit version 4)},
  institution = {Skillstore},
  year = {2026},
  number = {4},
  url = {https://skillstore.io/skills/firebase-firebase-basics/audits/4},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "firebase-basics security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
  - name: "firebase"
date-released: "2026-07-06"
url: "https://skillstore.io/skills/firebase-firebase-basics/audits/4"
identifiers:
  - type: other
    value: "skillstore:firebase-firebase-basics:audit:4"
    description: "Skillstore immutable audit report identifier"

Skillstore 評分

評分依據證據置信度: 高

架構

可維護性

內容

社群

規範符合度

你可以打造什麼

準備新的 Firebase 工作區

在開發開始前驗證 Node.js、安裝 Firebase CLI 存取、登入，並選擇正確的作用中專案。

將代理連接到 Firebase MCP

為 Claude Code、Cursor、Gemini CLI、GitHub Copilot 和 Antigravity 等工具新增或驗證 Firebase MCP 設定。

在應用程式中啟動 Firebase 服務

使用 Firebase CLI 指引來建立專案、初始化服務，並將 Firebase web SDK 設定加入應用程式。

試試這些提示

檢查我的 Firebase 設定

Use the firebase-basics skill to check whether my local environment is ready for Firebase development. Ask before running commands.

選擇正確的專案

Use the firebase-basics workflow to verify my active Firebase project and help me set the correct project alias.

設定 Firebase MCP

Use firebase-basics to review my agent environment and propose Firebase MCP setup steps. Show any configuration changes before applying them.

為 Web 應用程式初始化 Firebase

Use firebase-basics to create a Firebase setup plan for this web app, including project creation, service initialization, SDK setup, and verification.