A review skill from the official Firebase repository (authored by Google LLC): It enables agents to inspect Firestore and Cloud Storage security rules from a penetration tester's perspective, proactively identifying operation sequences that could bypass rules, scoring them on a 1–5 scale, and listing the severity and remediation suggestions for each issue in JSON format.
skills.sh install count 142227 (+576 / 24h)
Security Audit: Not Audited
- Not yet scanned
Rationale
- 6 mandatory checklist items: "Update bypass" where a valid document is created first and then updated to an invalid state; whether sensitive fields like role, isAdmin, and ownerId are derived from user-submitted data; whether the rules support business logic (e.g., collaborators being unable to read is also a flaw); whether strings and arrays have length limits; field type checks; and noting that hasOnly() / diff() only restrict which fields can be changed, not who can change them.
- Clear scoring tiers: 1 points indicate unauthorized reads, privilege escalation, or complete bypass of validation, while 5 points indicate comprehensive validation with strict ownership and role-based access control; a single hardcoded admin email does not incur a penalty if email_verified is also checked and admins cannot be added by the user.
- Fixed JSON output structure (score, summary, and findings containing check, severity, issue, and recommendation) for easy integration into CI or for before-and-after comparisons.
- Scope boundaries: Does not cover Firebase CLI login/deployment, Auth, Crashlytics, Remote Config, or database queries; the repository is licensed under Apache-2.0, and there are 12 other skills from the same repository on the leaderboard.
- skills.sh installs 576 in the last 24 hours, with a cumulative total of 142227 (indicating only level of attention).
Usage
- The installation command will be displayed after the audit passes; triggered by saying "review / red team test Firestore rules" or requesting scoring based on the audit checklist, passing firestore.rules or storage.rules to the agent.
- No account or external services are required; it is a pure text checklist and does not invoke the Firebase CLI.
Risks
- Not audited in this period, fixed at Grade C, and the installation command is not displayed; SKILL.md contains only a text checklist and output format, with no commands, scripts, or network requests; the Gen Agent Trust Hub audit on skills.sh is marked as Pass.
- It only statically reads rules and does not run Firebase emulators; identified "bypasses" must be reproduced by the user using emulators or unit tests; the checklist only covers 6 common issue categories.
- The prompt's scoring criteria are written for a specific scenario with "limited admin onboarding flows," which may be biased when applied to other projects; weekly installs have dropped from 5103 to 3607.