Skills firebase-firestore

📦

firebase-firestore

Name: firebase-firestore
Author: firebase

Content revision r1 Safe 🌐 Network access⚙️ External commands

使用安全規則設定 Firestore

Firestore 專案需要正確的設定、索引、SDK 使用方式和安全規則。此技能會引導資料庫工作流程和規則設計，協助更安全地發布。

Supports: Claude Codex Code(CC)

📊 73 Adequate

Maintain this Skill? Claim it 📊 73 Adequate

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "firebase-firestore" from https://skillstore.io/skills/firebase-firebase-firestore.md and its manifest at https://skillstore.io/api/skills/firebase-firebase-firestore/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/firebase-firebase-firestore.md Signed manifest GET /api/skills/firebase-firebase-firestore/manifest Signed lockfile GET /api/skills/firebase-firebase-firestore/lockfile

Test it

Using "firebase-firestore". 我需要 Firestore 來建置新的應用程式。

Expected outcome:

一份設定計畫，包含版本選擇、位置問題、初始設定檔、模擬器步驟和部署檢查。

Using "firebase-firestore". 我的 users 集合儲存公開個人資料和私人電子郵件。

Expected outcome:

建議分離公開和私人資料、限制僅擁有者可讀取，並驗證所有寫入欄位。

Using "firebase-firestore". 我的應用程式會依 owner、status 和 due date 篩選 tasks。

Expected outcome:

一份索引計畫，將每種查詢形狀對應到所需欄位、排序和部署步驟。

Security Audit

Safe

v6 • 7/9/2026 Open versioned report

Most static findings are false positives from Markdown examples, Firestore Rules syntax, or defensive security guidance. Five findings are confirmed because SKILL.md instructs agents to run Firebase CLI commands through npx, including metadata reads and database creation. No evidence found of prompt injection, credential exfiltration, or malicious intent.

Files scanned

3,190

Lines analyzed

Review items

False positives ignored

Capability review items (5)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:9

Ruby/shell backtick execution

compatibility: This skill is best used with the Firebase CLI, but does not require it. Firebase CLI

The skill directs agents to access Firebase CLI through npx, which installs and executes external tooling. This is legitimate but requires user confirmation because it reaches npm and Firebase services.

Medium

SKILL.md:19-20

Ruby/shell backtick execution

Run the following command to list current Firestore databases: `bash npx -y

The skill tells the agent to run firebase-tools through npx to list Firestore databases. This executes external networked tooling and may expose project metadata.

Medium

SKILL.md:24-25

Ruby/shell backtick execution

1. For each database found, inspect its edition and details: `bash npx -y

The skill tells the agent to query Firestore database details with firebase-tools. This executes external CLI tooling and reads cloud project metadata.

Medium

SKILL.md:38

Ruby/shell backtick execution

Run `npx -y firebase-tools@latest firestore:locations` to get the list of options.

The skill directs the agent to run firebase-tools to retrieve Firestore locations. This is a benign Firebase query but still executes external networked tooling.

Medium

SKILL.md:42

Ruby/shell backtick execution

`bash npx -y firebase-tools@latest firestore:databases:create <database-id> --edition="enterprise" -

The skill instructs database creation with firebase-tools. This can mutate cloud resources and should require explicit user approval for project, database, edition, and location.

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/firebase-firebase-firestore/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/firebase-firebase-firestore/security.svg)](https://skillstore.io/skills/firebase-firebase-firestore?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/firebase-firebase-firestore?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/firebase-firebase-firestore/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/firebase-firebase-firestore.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

firebase. (2026). firebase-firestore security audit report (audit version 6) [Author version unspecified]. Skillstore. https://skillstore.io/skills/firebase-firebase-firestore/audits/6

BibTeX citation

@techreport{firebase-firebase-firebase-firestore-2026,
  author = {firebase},
  title = {firebase-firestore security audit report (audit version 6)},
  institution = {Skillstore},
  year = {2026},
  number = {6},
  url = {https://skillstore.io/skills/firebase-firebase-firestore/audits/6},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "firebase-firestore security audit report (audit version 6)"
version: "unspecified"
type: report
authors:
  - name: "firebase"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/firebase-firebase-firestore/audits/6"
identifiers:
  - type: other
    value: "skillstore:firebase-firebase-firestore:audit:6"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

設定 Firestore 後端

建立資料庫計畫、設定檔、模擬器設定，以及初始的鎖定式規則。

強化安全規則

在發布前審查集合、擁有權規則、驗證檢查和攻擊情境。

規劃查詢索引

將應用程式查詢對應到所需的單一欄位、複合、稀疏或唯一索引。

Try These Prompts

選擇 Firestore 設定

協助我為我的應用程式選擇 Firestore 資料庫設定。詢問我使用的專案、區域和用戶端平台。

新增用戶端 SDK 使用方式

引導我將 Firestore 加入我的應用程式。包含正確的 SDK 路徑、初始化步驟和安全的查詢模式。

起草安全規則

分析我的 Firestore 集合並撰寫 Security Rules 原型。包含驗證、擁有權檢查，以及需審查的假設。

稽核規則和索引

審查我的 Firestore 規則和查詢模式。在部署前找出繞過風險、缺少的驗證，以及所需索引。

Best Practices

在執行 CLI 指令前確認 Firebase 專案和資料庫。
規則從預設拒絕開始，並只新增必要權限。
使用相同的領域專屬規則函式驗證建立和更新。

Avoid

不要在未審查和未進行模擬器測試的情況下部署產生的規則。
不要允許對包含私人資料的文件進行一概式已驗證讀取。
不要在未經使用者核准的情況下使用最新 CLI 指令進行正式環境變更。

Frequently Asked Questions

此技能可以建立 Firestore 資料庫嗎？

它可以引導 Firebase CLI 建立工作流程，但即時變更需要已驗證的存取權和使用者核准。

它支援 Enterprise Native Mode 嗎？

可以。它包含 Standard 和 Enterprise Native Mode Firestore 資料庫的個別指引。

它可以撰寫可用於正式環境的 Security Rules 嗎？

它可以起草強健的規則原型，但正式環境規則需要測試和人工安全審查。

涵蓋哪些用戶端平台？

參考資料涵蓋 web、Android、iOS、Flutter 和 Python 使用模式。

它會管理索引嗎？

可以。它說明索引檔案、查詢需求、稀疏索引和唯一索引行為。

它需要網路存取嗎？

即時 Firebase CLI 操作和版本檢查需要網路存取 Firebase 或 npm 服務。

Developer Details

Author

firebase

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/firebase/agent-skills/tree/main/skills/firebase-firestore/

Ref

0519034dad657fb1f7706e0550e962beeda73fdf

Maintenance freshness

7/18/2026

Usage

1 downloads · 8 views

File structure

📁 references/

📁 enterprise/

📄 android_sdk_usage.md

📄 data_model.md

📄 flutter_setup.md

📄 indexes.md

📄 ios_setup.md

📄 provisioning.md

📄 python_sdk_usage.md

📄 security_rules.md

📄 web_sdk_usage.md

📁 standard/

📄 android_sdk_usage.md

📄 flutter_setup.md

📄 indexes.md

📄 ios_setup.md

📄 provisioning.md

📄 security_rules.md

📄 web_sdk_usage.md

📄 SKILL.md

firebase-firestore

Install with my Agent

Agent-readable resources

Test it

Security Audit

Risk Factors

Copy report link

Markdown badge

HTML badge

Embed card

APA citation

BibTeX citation

CITATION.cff

Skillstore Score

What You Can Build

設定 Firestore 後端

強化安全規則

規劃查詢索引

Try These Prompts

Best Practices

Avoid

Frequently Asked Questions

Developer Details

More from firebase

firestore-security-rules-auditor

firebase-ai-logic-basics

firebase-security-rules-auditor

firebase-ai-logic