Agent skill · Firebase (Google)

Firebase Security Rules Auditor skill for Claude Code, Codex and Cursor

Audits Firestore and Storage rules for privilege escalation, bypasses and missing checks.

Officialname: firebase-security-rules-auditor★ 485 (repo)pushed 2026-10-20Apache-2.0SKILL.md on GitHubchecked 2026-11-07

What it does, in the publisher's words

Audits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege escalation, role bypasses, create vs update inconsistencies, resource exhaustion, type safety, size limits, and hasOnly ownership checks. Use when auditing/reviewing rules, running red-team rule assessments, or scoring against auditor checklists.

The description field of the SKILL.md. The agent reads only this at startup and decides from it when to load the full skill.

Install Firebase Security Rules Auditor

The skills CLI copies the skill into the folder of each agent you pick (Claude Code, Codex, Cursor, Copilot, Gemini CLI, OpenCode, Windsurf...). Add -g for all projects. Needs Node.js 22.20+. docs

npx skills add firebase/agent-skills --skill firebase-security-rules-auditor

This repo is a plugin marketplace. Inside Claude Code, add it and install the plugin that holds the skill (firebase), or copy only this skill into ~/.claude/skills. docs

/plugin marketplace add firebase/agent-skills
/plugin install <plugin>@firebase

# or only this skill:
npx skills add firebase/agent-skills --skill firebase-security-rules-auditor -a claude-code

Download the skill folder, zip it, then Customize > Skills > + > Create skill > Upload a skill. Code execution must be on (Settings > Capabilities). docs

git clone --depth 1 https://github.com/firebase/agent-skills.git /tmp/firebase-security-rules-auditor-src
cp -r /tmp/firebase-security-rules-auditor-src/skills/firebase-security-rules-auditor ./firebase-security-rules-auditor
zip -r firebase-security-rules-auditor.zip firebase-security-rules-auditor

Codex reads skills from .agents/skills in the repo or ~/.agents/skills. Type $ in Codex to use one. docs

npx skills add firebase/agent-skills --skill firebase-security-rules-auditor -a codex

gh skill (GitHub CLI 2.90+, preview) installs it for Copilot in VS Code, the CLI and the cloud agent. Copilot also reads .github/skills and ~/.copilot/skills. docs

gh skill install firebase/agent-skills firebase-security-rules-auditor

Cursor reads .cursor/skills, .agents/skills and ~/.cursor/skills (and .claude/skills). It does not install loose skills from a GitHub URL, so copy it in. docs

npx skills add firebase/agent-skills --skill firebase-security-rules-auditor -a cursor

Installs from the GitHub repo; --path picks this skill out of the repo. Default scope is user (all projects). docs

gemini skills install https://github.com/firebase/agent-skills.git --path skills/firebase-security-rules-auditor

OpenCode reads .opencode/skills, ~/.config/opencode/skills and the Claude and .agents folders. docs

npx skills add firebase/agent-skills --skill firebase-security-rules-auditor -a opencode

Windsurf (now Devin Desktop) reads .devin/skills, .windsurf/skills and ~/.codeium/windsurf/skills. docs

npx skills add firebase/agent-skills --skill firebase-security-rules-auditor -a windsurf

Works with

Claude Code, Claude.ai and Claude Desktop, Codex, GitHub Copilot, Cursor, Gemini CLI, OpenCode, Windsurf and other agents that read the open Agent Skills format.

What's in the SKILL.md

4 sections

Assessment: Security Validator (Red Team Edition)
Mandatory Audit Checklist:
Admin Bootstrapping & Privileges:
Scoring Criteria (1-5):

Facts

Skill name: firebase-security-rules-auditor
Publisher: Firebase (Google) (official)
Repo: firebase/agent-skills
License: Apache-2.0
SKILL.md size: 456 words, 77 lines
Repo stars: 485 (as of 2026-10-24)
SKILL.md checked: 2026-11-07

Pairs with the Firebase MCP server: the server gives the agent the tools, the skill teaches it how to use them.

More skills from firebase/agent-skills

Firebase Basics: Installs and logs into the Firebase CLI, creates or selects projects and fetches app config.
Cloud Firestore: Sets up Firestore databases: data modeling, queries, indexes, rules and SDK usage.

Related security & auth skills

Security Best Practices Review · OpenAI
Security Threat Model · OpenAI
Sign In With Google (Web) · Google
Agentic Actions Auditor · Trail of Bits
CodeQL Scan · Trail of Bits
Constant-Time Analysis · Trail of Bits
Differential Security Review · Trail of Bits
Semgrep Rule Creator · Trail of Bits

FAQ

What does the firebase-security-rules-auditor skill do?+

Audits Firestore and Storage rules for privilege escalation, bypasses and missing checks. In its own SKILL.md, Firebase (Google) describes it as: "Audits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege escalation, role bypasses, create vs update inconsistencies, resource exhaustion, type safety, size limits, and hasOnly ownership checks."

How do I install the firebase-security-rules-auditor skill?+

Run npx skills add firebase/agent-skills --skill firebase-security-rules-auditor and pick your agents, or use the tab for your agent above. In Claude Code the skill ends up in ~/.claude/skills/firebase-security-rules-auditor/SKILL.md; in Codex and Cursor in .agents/skills/firebase-security-rules-auditor/.

Does Firebase Security Rules Auditor work in Codex, Cursor and Copilot, or only Claude?+

It's a standard SKILL.md, so any agent that reads the Agent Skills format can use it: Claude Code, the Claude apps, Codex, GitHub Copilot, Cursor, Gemini CLI, OpenCode, Windsurf and more.

Who maintains Firebase Security Rules Auditor?+

Firebase (Google), the company or project behind it, in the firebase/agent-skills repo on GitHub, last pushed 2026-10-20. License: Apache-2.0.

Read a skill's SKILL.md and scripts before you install it: skills aren't verified by any agent vendor. Claude skills marketplace · How to install skills · MCP servers