56 results available
Sign in
Skills directory

firebase-remote-config-basics

firebase

·

Last changed
Hardened

This skill has been hardened by Chainguard

Last changed

This version passed the hardening gate. Hardening applied 1 targeted change and preserved all other text. Classified findings before hardening: 8. Classified findings closed: 0. Classified findings remaining: 8. Unclassified scanner findings remaining: 0. Review findings closed: 2. Review findings remaining: 17.


Open before hardening

3

Medium

5

Low
Open after hardening

3

Medium

5

Low

Expand
File
Group
Subtype
Severity
Status
references/ios_setup.md

Excessive Agency & Rogue Autonomy

—

Medium
Open
SKILL.md

Supply Chain & Install-Time Trust

—

Medium
Open
references/ios_setup.md

Supply Chain & Install-Time Trust

—

Medium
Open
references/ios_setup.md

Prompt Injection

Third-party content as instructions

Low
Open
SKILL.md

Malicious Code & Command Execution

—

Low
Open
SKILL.md

Supply Chain & Install-Time Trust

Install-time download and execute

Low
Open
references/ios_setup.md

Malicious Code & Command Execution

—

Low
Open
references/ios_setup.md

Supply Chain & Install-Time Trust

Install-time download and execute

Low
Open

8 findings


SKILL.md

Remote Config

This skill provides a complete guide for getting started with Remote Config on Android or iOS. Remote Config allows you to change the behavior and appearance of your app without publishing an app update by maintaining a cloud-based configuration template.

Prerequisites

Provisioning Remote Config requires both a Firebase project and a Firebase app, either Android or iOS. To manage the Remote Config template and conditions via the command line, use the Firebase CLI. See the firebase-basics skill for references on project initialization.

Troubleshooting Execution

Handling npx 403 Forbidden Errors

If npx -y firebase-tools@latest fails due to registry permissions (403 error):

  1. Inform the user: "I am unable to fetch the latest Firebase tools via npx due to a registry error."
  2. Fallback: Attempt to use the local firebase command directly if the user confirms it is installed globally.

Handling Project Context Issues

If a command fails because "no active project is selected":

  1. Check login: Run npx -y firebase-tools@latest login:list.
  2. Prompt for ID: If logged in but no project is active, ask the user: "Please provide your Firebase Project ID to proceed."
  3. Use Flag: Append --project <PROJECT_ID> to every subsequent command.

SDK Setup

To learn how to set up Remote Config in your application code, choose your platform:

  • Android: android_setup.md
  • iOS: ios_setup.md

Best Practices and Template Management

Follow these guidelines and use the associated CLI tools to ensure efficient and safe use of Remote Config.

Fetching Strategies

To optimize app performance and user experience, follow these recommended patterns (see Loading Strategies):

  • Load new values for next startup: The most effective pattern is to activate previously fetched values immediately on startup and fetch new values in the background to be used next time. This minimizes user wait time.
  • Real-time Updates: Use the SDK's real-time listener to update the app instantly without a refresh when server-side configuration changes.

Template Management via CLI

Use the following commands to manage your Remote Config template and version history through the terminal:

  • Get current template: Save the remote template to a local JSON file for auditing or modification.

    npx -y firebase-tools@latest remoteconfig:get -o remote_config.json
  • Autonomous Editing & Discovery : Modify the local remote_config.json directly. Determine the correct signal (e.g., device.country or percent) and update the "conditions" array and "parameters" map accordingly.

  • MANDATORY: User Review and Verification : STOP and ask the user to verify your changes before proceeding to deployment.

    • Action: Inform the user: "I have prepared the changes in remote_config.json. Please review the file for accuracy. Once you are satisfied, tell me to 'deploy' to make the changes live."
  • Deployment Orchestration : To push changes, you must ensure the environment is configured for deployment.

    • Config Mapping: If a firebase.json file is missing, create one to map the local JSON to the Remote Config service:
      { "remoteconfig": { "template": "remote_config.json" } }
    • Deploy: Execute the partial deployment command

      npx -y firebase-tools@latest deploy --only remoteconfig
  • Verification: After deployment, verify the update by listing the version history.

    npx -y firebase-tools@latest remoteconfig:versions:list

The SDK provides a number of features to make your application dynamic and responsive to user segments.

  • Set In-App Defaults: Define baseline values to ensure the app functions offline or before the first fetch.
  • Fetch and Activate: Retrieve values from the Firebase backend and apply them to the local UI/Logic.
  • Template Management: Use the Firebase CLI to version-control, get, and deploy your config JSON files.

Install

Install with chainctl
chainctl skill install public/firebase/firebase-remote-config-basics:latest
Get started with chainctl
View source

Harden your own skills

Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.

Provenance

Upstream sourcehttps://github.com/firebase/agent-skills
Upstream commitbf6538ef0e147831adc04c31291549f7dc399e97
OCI reference

skills.cgr.dev/public/github.com/firebase/skills/firebase-remote-config-basics:latest

License

Apache-2.0

Files

HARDENING.md

LICENSE

SKILL.md

references/android_setup.md

references/ios_setup.md


The trusted source for open source

Talk to an expert
PrivacyTerms

Product

Chainguard ContainersChainguard LibrariesChainguard VMsChainguard OS PackagesChainguard ActionsChainguard Agent SkillsIntegrationsPricing
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.