56 results available
Sign in
Skills directory

firebase-data-connect-basics

firebase

·

Last changed
Hardened

This skill has been hardened by Chainguard

Last changed

This version passed the hardening gate. Hardening applied 32 targeted changes and preserved all other text. Classified findings before hardening: 15. Classified findings closed: 8. Classified findings remaining: 7. Unclassified scanner findings remaining: 0. Review findings closed: 2. Review findings remaining: 9.


Open before hardening

6

Medium

9

Low
Open after hardening

6

Medium

1

Low

Expand
File
Group
Subtype
Severity
Status
reference/schema.md

Prompt Injection

Direct prompt injection

Medium
Open
reference/sdk_admin_node.md

Supply Chain & Install-Time Trust

—

Medium
Open
templates.md

Supply Chain & Install-Time Trust

—

Medium
Open
SKILL.md

Supply Chain & Install-Time Trust

—

Medium
Open
reference/config.md

Supply Chain & Install-Time Trust

—

Medium
Open
SKILL.md

Prompt Injection

Direct prompt injection

Medium
Open
reference/config.md

Supply Chain & Install-Time Trust

Install-time download and execute

Low
Closed
SKILL.md

Malicious Code & Command Execution

—

Low
Closed

15 findings


SKILL.md

Firebase SQL Connect

Firebase SQL Connect is a relational database service using Cloud SQL for PostgreSQL with GraphQL schema, auto-generated queries/mutations, and type-safe SDKs.

Project Structure

dataconnect/
├── dataconnect.yaml      # Service configuration
├── seed_data.gql         # LOCAL ONLY — prototype/test data
├── schema/
│   └── schema.gql        # Data model (types with @table)
└── connector/
    ├── connector.yaml    # Connector config + SDK generation
    ├── queries.gql       # Queries
    └── mutations.gql     # Mutations

Key Tools for Validation

Rely on these two mechanisms to ensure project correctness:

  1. Review GraphQL Schema: Both user-defined and generated extensions (in .dataconnect/schema/main/).
  2. Validate Operations: Run npx firebase-tools@latest dataconnect:compile against the schema.

Operation Strategies: GraphQL vs. Native SQL

Always default to Native GraphQL. Native SQL lacks type safety and bypasses schema-enforced structures. Only use Native SQL when the user explicitly requests it or when the task requires advanced database features.

StrategyWhen to useImplementation

Native GraphQL (Default)

Almost all use cases. Standard CRUD, basic filtering/sorting, simple relational joins. Requires full type safety.

Auto-generated fields (movie_insert, movies). Strong typing and schema enforcement.

Native SQL (Advanced)

PostgreSQL extensions (e.g., PostGIS), window functions (RANK()), complex aggregations, or highly tuned sub-queries.

Raw SQL string literals via _select, _execute, etc. Requires strict positional parameters ($1). No type safety.

Development Workflow

Follow this strict workflow to build your application. You must read the linked reference files for each step to understand the syntax and available features.

1. Define Data Model (schema/schema.gql)

Define your GraphQL types, tables, and relationships (which map to a Postgres schema).

2. Define Authorized Operations (connector/queries.gql, connector/mutations.gql)

Write the queries and mutations your client will use, including authorization logic. SQL Connect is secure by default.

3. Use type-safe SDK in your apps

Generate type-safe code for your client platform.

Configure SDK generation in connector.yaml:

connectorId: my-connector
generate:
  javascriptSdk:
    outputDir: "../web-app/src/lib/dataconnect"
    package: "@movie-app/dataconnect"
  kotlinSdk:
    outputDir: "../android-app/app/src/main/kotlin/com/example/dataconnect"
    package: "com.example.dataconnect"
  swiftSdk:
    outputDir: "../ios-app/DataConnect"
    package: "DataConnectGenerated"

Generate SDKs:

npx firebase-tools@latest dataconnect:sdk:generate

For platform-specific instructions on how to use the generated SDKs, read:


Feature Capability Map

If you need to implement a specific feature, consult the mapped reference file:

FeatureReference FileKey Concepts

Data Modeling

reference/schema.md

@table, @unique, @index, Relations

Vector Search

reference/search.md

Vector, @col(dataType: "vector"), embeddings

Full-Text Search

reference/search.md

@searchable, movies_search

Upserting Data

reference/operations.md

_upsert mutations

Complex Filters

reference/operations.md

_or, _and, _not, eq, contains

Transactions

reference/operations.md

@transaction, response binding

Environment Config

reference/config.md

dataconnect.yaml, connector.yaml

Realtime Subscriptions

reference/realtime.md

@refresh, subscribe(), auto-refresh

Cloud Functions Integration

reference/cloud_functions.md

onMutationExecuted, triggering events

Data Seeding & Migrations

reference/data_seeding.md

seed_data.gql, _insertMany, Admin SDK bulk

Starter Templates

templates.md

CRUD, user-owned resources, many-to-many, SDK init


Deployment & CLI

Follow these patterns based on your current task:

How to initialize SQL Connect in a Firebase project

  1. Understand the app idea. Ask clarification questions if unclear.
  2. Run npx firebase-tools@latest init dataconnect.
  3. Validate that the app template and generated SDK are setup.

How to build apps using SQL Connect locally

  1. Start the emulator: npx firebase-tools@latest emulators:start --only dataconnect.
  2. Write schema and operations.
  3. Seed local test data into seed_data.gql. Read reference/data_seeding.md.
  4. Run npx firebase-tools@latest dataconnect:compile or npx firebase-tools@latest dataconnect:sdk:generate to validate them.
  5. Use the operations in your app and build it.

How to deploy SQL Connect to Cloud SQL

  1. Run npx firebase-tools@latest deploy --only dataconnect.

Examples

For complete, working code examples of schemas and operations, see examples.md.

For ready-to-use starter templates (CRUD, user-owned resources, many-to-many, YAML configs, SDK init), see templates.md.

Install

Install with chainctl
chainctl skill install public/firebase/firebase-data-connect-basics:latest
Get started with chainctl
View source

Harden your own skills

Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.

Provenance

Upstream sourcehttps://github.com/firebase/agent-skills
Upstream commit551653e800807378a3d9220b3c5547a06c01625b
OCI reference

skills.cgr.dev/public/github.com/firebase/skills/firebase-data-connect-basics:latest

License

Apache-2.0

Files

HARDENING.md

LICENSE

SKILL.md

examples.md

reference/cloud_functions.md

reference/config.md

reference/data_seeding.md

reference/native_sql.md

reference/operations.md

reference/realtime.md

reference/schema.md

reference/sdk_admin_node.md

reference/sdk_android.md

reference/sdk_flutter.md

reference/sdk_ios.md

reference/sdk_web.md

reference/search.md

reference/security.md

templates.md


The trusted source for open source

Talk to an expert
PrivacyTerms

Product

Chainguard ContainersChainguard LibrariesChainguard VMsChainguard OS PackagesChainguard ActionsChainguard Agent SkillsIntegrationsPricing
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.