·
Last changedVersion:
This version passed the hardening gate. Hardening updated the skill content and independently checked the resulting changes. Classified findings before hardening: 56. Classified findings closed: 11. Classified findings remaining: 45. Unclassified scanner findings remaining: 0. Review findings closed: 0. Review findings remaining: 21.
1
21
34
21
24
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
references/refresh/android_studio.md | Excessive Agency & Rogue Autonomy | — | High | Closed | |
references/setup/antigravity.md | Supply Chain & Install-Time Trust | — | Medium | Open | |
references/refresh/android_studio.md | Supply Chain & Install-Time Trust | — | Medium | Open | |
references/flutter_setup.md | Supply Chain & Install-Time Trust | — | Medium | Open | |
references/web_setup.md | Supply Chain & Install-Time Trust | — | Medium | Open | |
references/android_setup.md | Supply Chain & Install-Time Trust | — | Medium | Open | |
references/setup/gemini_cli.md | Supply Chain & Install-Time Trust | — | Medium | Open | |
references/firebase-service-init.md | Supply Chain & Install-Time Trust | — | Medium | Open |
56 findings
Complete these setup steps before proceeding:
Local Environment Setup: Verify the environment is properly set up so we can use Firebase tools:
npx -y firebase-tools@latest --version to check if the Firebase CLI
is installed.Authentication: Ensure you are logged in to Firebase so that commands
have the correct permissions. Run npx -y firebase-tools@latest login. For
environments without a browser (e.g., remote shells), use
npx -y firebase-tools@latest login --no-localhost.
Active Project: Most Firebase tasks require an active project context.
If using an existing Project ID:
Check the current project by running npx -y firebase-tools@latest use.
If the command outputs Active Project: <project-id>, confirm with the
user if this is the intended project.
If not, or if no project is active, set the project provided by the user:
If creating a new project: Run the following command to create it:
Note: The <project-id> must be 6-30 characters, lowercase, and can
contain digits and hyphens. It must be globally unique.
Adhere to these principles:
npx -y firebase-tools@latest
instead of just firebase. For example, use
npx -y firebase-tools@latest --version.developerknowledge_search_documents MCP tool before falling
back to Google Search or your internal knowledge base. Including "Firebase"
in your search query significantly improves relevance.google-services.json
or GoogleService-Info.plist. Instead, use the Firebase CLI to fetch the
config programmatically:
npx -y firebase-tools@latest apps:sdkconfig ANDROID <APP_ID> --project <PROJECT_ID>npx -y firebase-tools@latest apps:sdkconfig IOS <APP_ID> --project <PROJECT_ID>
Save the output to the appropriate location (e.g.,
app/google-services.json for Android, or a path to be linked by
xcode-project-setup for iOS).npx -y firebase-tools@latest login --no-localhost instead.Get started with chainctlchainctl skill install public/firebase/firebase-basics:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/firebase/skills/firebase-basics:latest
Apache-2.0
HARDENING.md
LICENSE
SKILL.md
references/android_setup.md
references/firebase-cli-guide.md
references/firebase-service-init.md
references/flutter_setup.md
references/ios_setup.md
references/local-env-setup.md
references/refresh/android_studio.md
references/refresh/antigravity.md
references/refresh/claude.md
references/refresh/gemini-cli.md
references/refresh/other-agents.md
references/setup/android_studio.md
references/setup/antigravity.md
references/setup/claude_code.md
references/setup/cursor.md
references/setup/gemini_cli.md
references/setup/github_copilot.md
references/setup/other_agents.md
references/web_setup.md