Skip to content
skillsafebeta
← Report library
Purpose / Data analysis

Firebase Auth Basics Skill Security Audit

What the author says it does (original text)

Guide for setting up and using Firebase Authentication. Use this skill when the user's app requires user sign-in, user management, or secure data access using auth rules.

Independent security check

Do not install or run it yet

Files checked
6
Risks found
4
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

Unpinned `npx -y` automatically downloads and executes the latest CLI

Source references: 6
What we found

Several steps use `npx -y firebase-tools@latest`. The `-y` flag skips installation confirmation, while `@latest` does not pin a reviewed release, so future package contents execute locally with the terminal's access and any permissions available to the logged-in Firebase CLI.

Why this matters

A compromised, faulty, or incompatible release could affect local files, CLI credentials, or Firebase projects, and the executed code may change between runs.

These are executable install/run commands. `@latest` may resolve to a different, unreviewed release over time, while `-y` suppresses npx's installation confirmation; the resulting CLI can then use the terminal and logged-in Firebase access to create projects, initialize, or deploy configuration. This is a common convenience pattern and does not imply a malicious package, but it creates real supply-chain and version-drift exposure. Users can require a pinned version and verify the package and target project first.

SKILL.md:3In the instructionsOpen original file
name: firebase-auth-basicsdescription: Guide for setting up and using Firebase Authentication. Use this skill when the user's app requires user sign-in, user management, or secure data access using auth rules.compatibility: This skill is best used with the Firebase CLI, but does not require it. Firebase CLI can be accessed through `npx -y firebase-tools@latest`.metadata:
Show 5 other places
SKILL.md:11In the instructionsOpen original file
- **Firebase Project**: Created via  `npx -y firebase-tools@latest projects:create` (see `firebase-basics`).- **Firebase CLI**: Installed and logged in (see `firebase-basics`).
references/client_sdk_android.md:8In the instructionsOpen original file
Before adding dependencies in your app, make sure you enable the Auth service inyour Firebase Project using the Firebase CLI:```bashnpx -y firebase-tools@latest init auth```
SKILL.md:4In the instructionsOpen original file
description: Guide for setting up and using Firebase Authentication. Use this skill when the user's app requires user sign-in, user management, or secure data access using auth rules.compatibility: This skill is best used with the Firebase CLI, but does not require it. Firebase CLI can be accessed through `npx -y firebase-tools@latest`.metadata:
SKILL.md:95In the instructionsOpen original file
```bashnpx -y firebase-tools@latest deploy --only auth```
references/client_sdk_android.md:11In the instructionsOpen original file
```bashnpx -y firebase-tools@latest init auth```
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Email addresses persist in script-readable localStorage

Source references: 2
What we found

The passwordless sign-in example writes the user's email to `window.localStorage` and removes it only after successful completion. localStorage survives navigation and browser restarts and is readable by same-origin scripts; the shown failure and abandoned-flow paths do not clear it.

Why this matters

A later user on a shared device, an XSS payload, or a compromised same-origin script could obtain the email address, creating a privacy leak or useful phishing data.

The example persistently writes the email to the current origin's localStorage. The later code removes it only in the successful `.then` branch; send failures, abandoned links, and failed completion have no cleanup. The address may therefore survive navigation or browser restarts and remain readable to same-origin page scripts, creating privacy exposure, particularly on shared devices or if such scripts are compromised. Users can require shorter-lived storage, failure/cancellation cleanup, and suitable content-security controls.

references/client_sdk_web.md:234In the instructionsOpen original file
sendSignInLinkToEmail(auth, email, actionCodeSettings)  .then(() => {    // Save the email locally so you don't need to ask the user for it again    window.localStorage.setItem('emailForSignIn', email);  })  .catch((error) => {    // Error  });```
Show 1 other places
references/client_sdk_web.md:251In the instructionsOpen original file
if (isSignInWithEmailLink(auth, window.location.href)) {  let email = window.localStorage.getItem('emailForSignIn');  if (!email) {    email = window.prompt('Please provide your email for confirmation');  }  signInWithEmailLink(auth, email, window.location.href)    .then((result) => {      window.localStorage.removeItem('emailForSignIn');      // You can check result.user    })    .catch((error) => {      // Error    });}
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 2
High risk

Example rule can grant every signed-in identity read/write access

Source references: 4
What we found

The rule `request.auth != null` checks only that an identity exists; it does not verify ownership, roles, or permissions. The Skill's configuration also enables anonymous authentication, allowing an outsider to obtain an identity that satisfies this check.

Why this matters

If applied broadly to private or important data, any registered—and potentially anonymous—user could read, alter, or delete data in the matched scope.

The risk is plausible under a specific implementation: the sample auth configuration enables anonymous sign-in, and the signed-in-only rule is also satisfied by anonymous users. If applied to a broad match scope, anyone able to sign in could read or write that scope. The guide later shows an ownership check, so this does not affect every example; users should verify that deployed rules also enforce UID, role, or resource ownership.

SKILL.md:70In the instructionsOpen original file
  "authorizedDomains": ["localhost"],    "providers": {      "anonymous": true,      "emailPassword": true,      "googleSignIn": {        "oAuthBrandDisplayName": "Your Brand Name",
Show 3 other places
references/security_rules.md:12In the instructionsOpen original file
### Check if user is signed in```allow read, write: if request.auth != null;```
SKILL.md:68In the instructionsOpen original file
{  "auth": {  "authorizedDomains": ["localhost"],    "providers": {      "anonymous": true,      "emailPassword": true,      "googleSignIn": {        "oAuthBrandDisplayName": "Your Brand Name",
references/security_rules.md:18In the instructionsOpen original file
### Check if user owns the dataAccess data only if the document ID matches the user's UID.```allow read, write: if request.auth != null && request.auth.uid == userId;```
Medium risk

Mandatory deployment step can change the wrong Firebase project

Source references: 3
What we found

The guide says the authentication deployment “MUST” be run but does not require checking the active project, environment, or configuration diff first. Deployment writes the local provider and authorized-domain settings to the selected Firebase backend and may create OAuth clients.

Why this matters

If the CLI points to production or another project, sign-in methods, authorized domains, and OAuth configuration may be changed unintentionally, potentially breaking login or widening accepted login origins.

This is an instruction to change a live backend, not merely an illustrative snippet. The Skill assumes a logged-in CLI and says the deployment must be run, but the shown procedure does not require confirming the selected Firebase project or reviewing the configuration first. If the CLI targets the wrong project, auth providers, authorized domains, and related OAuth configuration could reach the wrong environment. Users can require explicit project-ID, alias, and diff confirmation before deployment.

SKILL.md:64In the instructionsOpen original file
Configure Firebase Authentication in `firebase.json` by adding an 'auth' block:```{  "auth": {  "authorizedDomains": ["localhost"],    "providers": {      "anonymous": true,      "emailPassword": true,      "googleSignIn": {        "oAuthBrandDisplayName": "Your Brand Name",        "supportEmail": "support@example.com"      }    }  }}```
Show 2 other places
SKILL.md:90In the instructionsOpen original file
**CRITICAL**: After configuring `firebase.json`, you MUST deploy the authconfiguration to the Firebase backend for the changes to take effect. This isessential for auth providers like Google Sign-In, email/password, etc. toauto-generate the necessary OAuth clients for your app platforms. Run:```bashnpx -y firebase-tools@latest deploy --only auth```
SKILL.md:11In the instructionsOpen original file
- **Firebase Project**: Created via  `npx -y firebase-tools@latest projects:create` (see `firebase-basics`).- **Firebase CLI**: Installed and logged in (see `firebase-basics`).
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

3 instruction sections

This Skill is a Firebase Authentication setup and client-integration guide covering Web, Flutter, Android, and iOS. It recommends using the Firebase CLI to create projects, enable identity providers, and deploy authentication configuration.

View source
SKILL.md:2In the instructionsOpen original file
---name: firebase-auth-basicsdescription: Guide for setting up and using Firebase Authentication. Use this skill when the user's app requires user sign-in, user management, or secure data access using auth rules.compatibility: This skill is best used with the Firebase CLI, but does not require it. Firebase CLI can be accessed through `npx -y firebase-tools@latest`.metadata:
SKILL.md:90In the instructionsOpen original file
**CRITICAL**: After configuring `firebase.json`, you MUST deploy the authconfiguration to the Firebase backend for the changes to take effect. This isessential for auth providers like Google Sign-In, email/password, etc. toauto-generate the necessary OAuth clients for your app platforms. Run:```bashnpx -y firebase-tools@latest deploy --only auth```

The Web examples cover email/password, anonymous sign-in, and several third-party popup providers. The examples obtain provider access tokens from sign-in results, but the shown code does not transmit or persist those tokens.

View source
references/client_sdk_web.md:57In the instructionsOpen original file
signInWithPopup(auth, provider)  .then((result) => {    // This gives you a Google Access Token. You can use it to access the Google API.    const credential = GoogleAuthProvider.credentialFromResult(result);    const token = credential.accessToken;    // The signed-in user info.    const user = result.user;    // ...  })
references/client_sdk_web.md:204In the instructionsOpen original file
## Sign In Anonymously```javascriptimport { getAuth, signInAnonymously } from "firebase/auth";const auth = getAuth();signInAnonymously(auth)  .then(() => {    // Signed in..  })  .catch((error) => {    const errorCode = error.code;    const errorMessage = error.message;  });```

The security-rules reference shows both an “any signed-in user” pattern and an owner-only pattern. The resulting protection depends on which rule the user adopts.

View source
references/security_rules.md:12In the instructionsOpen original file
### Check if user is signed in```allow read, write: if request.auth != null;```
references/security_rules.md:18In the instructionsOpen original file
### Check if user owns the dataAccess data only if the document ID matches the user's UID.```allow read, write: if request.auth != null && request.auth.uid == userId;```(Where `userId` is a path variable, e.g., `match /users/{userId}`)

The provided content does not show instructions to upload credentials, covertly change payments, delete files, or bypass review. Its visible external actions are primarily Firebase CLI operations, Firebase Console configuration, and identity-provider sign-in.

View source
SKILL.md:99In the instructionsOpen original file
#### Option 2. Enabling Authentication in ConsoleEnable other providers in the Firebase Console.1. Go to the   https://console.firebase.google.com/project/_/authentication/providers1. Select your project.1. Enable the desired Sign-in providers (e.g., Email/Password, Google).
Start here · InstructionsSKILL.md
firebase-auth-basics
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.

File reference map

References: 4
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records6 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • references/client_sdk_android.mdFull text included
  • references/client_sdk_web.mdFull text included
  • references/flutter_setup.mdFull text included
  • references/security_rules.mdFull text included
  • references/ios_setup.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • references/client_sdk_android.mdSupporting file
  • references/client_sdk_web.mdSupporting file
  • references/flutter_setup.mdSupporting file
  • references/ios_setup.mdSupporting file
  • references/security_rules.mdSupporting file

Operations mentioned in code and instructions

Install extra software packages
SKILL.md:4In the instructionsOpen original file
description: Guide for setting up and using Firebase Authentication. Use this skill when the user's app requires user sign-in, user management, or secure data access using auth rules.compatibility: This skill is best used with the Firebase CLI, but does not require it. Firebase CLI can be accessed through `npx -y firebase-tools@latest`.metadata:
SKILL.md:12In the instructionsOpen original file
- **Firebase Project**: Created via  `npx -y firebase-tools@latest projects:create` (see `firebase-basics`).- **Firebase CLI**: Installed and logged in (see `firebase-basics`).
SKILL.md:96In the instructionsOpen original file
```bashnpx -y firebase-tools@latest deploy --only auth```
Connect to websites
SKILL.md:88In the instructionsOpen original file
> protocol or port number in the Authorized Domains list (e.g., use `localhost`,> NOT `http://localhost:9090`).
SKILL.md:104In the instructionsOpen original file
1. Go to the   https://console.firebase.google.com/project/_/authentication/providers1. Select your project.
references/client_sdk_android.md:24In the instructionsOpen original file
dependencies {    // [AGENT] Fetch the latest available BoM version from https://firebase.google.com/support/release-notes/android before adding this    implementation(platform("com.google.firebase:firebase-bom:<latest_bom_version>"))
Run commands
SKILL.md:95In the instructionsOpen original file
```bashnpx -y firebase-tools@latest deploy --only auth
references/client_sdk_android.md:11In the instructionsOpen original file
```bashnpx -y firebase-tools@latest init auth
Lines read
872
File checksum (to compare versions)
e463737e70eb185cbfc60871e16e65c4503a323f58f19fc6b40ad3509b95c71f