Skip to content
skillsafebeta
← Report library
Purpose / Other

Firebase Crashlytics Skill Security Audit

What the author says it does (original text)

Comprehensive guide for Firebase Crashlytics, including provisioning and SDK usage. Use this skill when the user needs help setting up Crashlytics, adding crash reporting, or using the Crashlytics SDK in their application.

Independent security check

Security risks found

Files checked
3
Risks found
5
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

Commands download and execute an unpinned Firebase CLI release

Source references: 2
What we found

The guide repeatedly uses `npx -y firebase-tools@latest`. `-y` accepts installation automatically, while `latest` changes over time, so the executed code is not a fixed version covered by this review.

Why this matters

If the npm package, a dependency, or a future release becomes malicious or destructive, it runs with the agent user's privileges and may reach project files and the logged-in Firebase session.

This guide does not execute commands merely by being read. However, if an agent follows it, `npx -y` automatically approves installation and runs whichever Firebase CLI release `latest` points to at that time. Because the version is unpinned, the executed code can change and is not reproducible. Users can require a reviewed, pinned version or restrict installation and network access.

SKILL.md:4In the instructionsOpen original file
description: Comprehensive guide for Firebase Crashlytics, including provisioning and SDK usage. Use this skill when the user needs help setting up Crashlytics, adding crash reporting, or using the Crashlytics SDK in their application.compatibility: This skill is best used with the Firebase CLI, but does not require it. Firebase CLI can be accessed through `npx -y firebase-tools@latest`.metadata:
Show 1 other places
references/android_setup.md:14In the instructionsOpen original file
- **Firebase CLI**: Installed and logged in (see `firebase-basics`).- **Firebase Project**: Created via  `npx -y firebase-tools@latest projects:create` (see `firebase-basics`).- **Firebase App**: Created via  `npx -y firebase-tools@latest apps:create <IOS|ANDROID|WEB> <package-name-or-bundle-id>`
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 2
Medium risk

Crash reports and optional user identifiers are sent to Firebase

Source references: 3
What we found

The Skill states that Crashlytics collects client crash data and offers custom logs, keys, and user identifiers. Its test flow confirms that a report uploads on the next launch.

Why this matters

If crash context, logs, or identifiers contain personal information, tokens, request contents, or business data, that information leaves the device and becomes available through the Firebase project and its MCP/console readers.

Crashlytics is expressly intended to collect client crash data and send reports to Firebase; the test report uploads on the next launch. Custom keys, logs, and user identifiers are listed capabilities rather than values this guide automatically adds, but enabling them can place personal or sensitive debugging information in reports. Users can require a field inventory, exclude direct identifiers and secrets, and restrict Firebase access and retention.

SKILL.md:11In the instructionsOpen original file
This skill provides a complete guide for getting started with Crashlytics onAndroid or iOS. Crash data collected from client applications can be read usingthe MCP server in the Firebase CLI.
Show 2 other places
SKILL.md:31In the instructionsOpen original file
The SDK provides a number of features to make crash reports more actionable.- Add custom keys- Add custom logs- Set user identifiers- Report non-fatal exceptions
references/android_setup.md:131In the instructionsOpen original file
1. Restart the app. The Crashlytics SDK will send the crash report to Firebase   on the next app launch.1. After a few minutes, the crash should be available in the Firebase console.   Go to **DevOps & Engagement** > **Crashlytics** to view your dashboard and   crash reports.- If the Firebase MCP server is installed, use the `get_report` tool to check  that a crash was received.- As a fallback, visit the Crashlytics dashboard in the Firebase console to see
Medium risk

Builds upload native symbols or iOS dSYM files to Crashlytics

Source references: 2
What we found

Android configuration can automatically upload native symbols, while iOS setup requires adding a Crashlytics dSYM upload script to the main target. This can occur during later builds, not only for the one test crash.

Why this matters

Symbol files can disclose proprietary implementation metadata such as internal classes, functions, or build structure to the Firebase project. Weak project access controls can broaden who may reach that material.

When these configurations are enabled and builds run, the optional Android setting automatically uploads native symbols, while the iOS guide requires a Crashlytics script that uploads dSYM files. These files are normally needed to decode crash stacks, but they are still build artifacts sent to Firebase and the configuration can affect later builds. Users can require confirmation of the destination, build types, and retention policy, and permit uploads only to an approved Firebase project.

references/android_setup.md:89In the instructionsOpen original file
1. Enable the `nativeSymbolUpload` flag in your `buildTypes` configuration. This   will automatically upload symbol files for your native code, which are   required to symbolicate native crash reports.   ```kotlin   android {       // ... other config       buildTypes {           getByName("release") {               // ...               firebaseCrashlytics {                   nativeSymbolUploadEnabled = true               }           }
Show 1 other places
references/ios_setup.md:36In the instructionsOpen original file
## Add dSYM Upload ScriptAdd a Run Script phase to the main app target in Xcode. This step is required toupload dSYM files for crash symbolication.1. **Debug Information Format**: The `Debug Information Format` in Build   Settings must be set to `DWARF with dSYM File`.1. **Run Script Content**: A new "Run Script Phase" should be added to the   target's "Build Phases" with the following content:   ```bash   ${BUILD_DIR%/Build/*}/SourcePackages/checkouts/firebase-ios-sdk/Crashlytics/run   ```
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 1
Medium risk

The required test writes crash-on-start code into the application

Source references: 5
What we found

Both Android and iOS instructions add a delayed exception or `fatalError` to the app startup path. Although removal is instructed after verification, cleanup is a later manual step.

Why this matters

If committed, built, or released without cleanup, the app will crash about three seconds after each launch, making a test, demo, or production build unusable.

Both guides label a forced crash as a required verification step and place it in the startup path. If run in a normal development, testing, or release build, the app exits after about three seconds and can remain unusable if cleanup is forgotten. The guide does require later removal, so this is intentional testing behavior that depends on a manual cleanup step. Users can restrict it to an isolated debug build or test device and verify removal before release.

references/android_setup.md:115In the instructionsOpen original file
1. Add code to your main activity (e.g., in `onCreate`) to trigger a crash a few   seconds after app startup:   ```kotlin   import android.os.Handler   import android.os.Looper   // ... in your Activity's onCreate method or similar startup logic   Handler(Looper.getMainLooper()).postDelayed({       throw RuntimeException("Test Crash") // Force a crash after 3 seconds   }, 3000)   ```
Show 4 other places
references/android_setup.md:143In the instructionsOpen original file
5. After verifying that Firebase has received the crash report - either using   the `get_report` tool or manually viewing it in the Firebase console - remove   the code from step 1 that triggers the crash. This prevents the application   from always crashing on start up after a delay.
references/ios_setup.md:76In the instructionsOpen original file
class AppDelegate: NSObject, UIApplicationDelegate {  func application(_ application: UIApplication,                   didFinishLaunchingWithOptions launchOptions: [UIApplication.LaunchOptionsKey : Any]? = nil) -> Bool {    FirebaseApp.configure()    // Force a crash after a delay to test Crashlytics    DispatchQueue.main.asyncAfter(deadline: .now() + 3) {        fatalError("Test Crash")    }    return true  }}```
references/ios_setup.md:106In the instructionsOpen original file
5. After verifying that Firebase has received the crash report - either using   the `get_report` tool or manually viewing it in the Firebase console - remove   the code from step 1 that triggers the crash. This prevents the application   from always crashing on start up after a delay.
references/android_setup.md:110In the instructionsOpen original file
### Required: Force a Test CrashTo verify that Crashlytics is correctly installed, you need to force a testcrash in the app.1. Add code to your main activity (e.g., in `onCreate`) to trigger a crash a few   seconds after app startup:   ```kotlin   import android.os.Handler   import android.os.Looper   // ... in your Activity's onCreate method or similar startup logic   Handler(Looper.getMainLooper()).postDelayed({       throw RuntimeException("Test Crash") // Force a crash after 3 seconds   }, 3000)   ```
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Medium risk

The guide can create cloud projects and apps in the currently logged-in Firebase account

Source references: 3
What we found

When local configuration is absent, the guide permits direct CLI creation of Firebase projects and apps. The shown steps do not first verify the active account, organization, target project, or request per-resource confirmation.

Why this matters

The agent could leave unintended cloud resources, app registrations, and related permission configuration in the wrong personal or company account.

If no existing configuration is found, the guide permits creating projects and apps in the currently logged-in Firebase account, which changes cloud-account state. The shown steps do not identify or verify the signed-in account, organization, or billing ownership, and show no per-operation confirmation. Users can require the current identity, destination project, organization, and expected cost to be displayed and approve each creation separately.

references/android_setup.md:10In the instructionsOpen original file
Before you begin, ensure you have the following. If a `google-services.json`file is present, then use that Firebase project and app. Otherwise you may needto create them.- **Firebase CLI**: Installed and logged in (see `firebase-basics`).- **Firebase Project**: Created via  `npx -y firebase-tools@latest projects:create` (see `firebase-basics`).- **Firebase App**: Created via  `npx -y firebase-tools@latest apps:create <IOS|ANDROID|WEB> <package-name-or-bundle-id>`
Show 2 other places
references/ios_setup.md:11In the instructionsOpen original file
Use the `firebase-tools` CLI to set up the project if necessary.1. **Find Bundle ID:** Read the Xcode project to find the iOS bundle ID. Check   the `PRODUCT_BUNDLE_IDENTIFIER` value in the `.pbxproj` file or the   `Info.plist` file.1. **Create Firebase Project:** If no project exists, create one:   `npx -y firebase-tools@latest projects:create <project-id> --display-name="My Awesome App"`1. **Create Firebase App:** Register the iOS app with the discovered bundle ID:   `npx -y firebase-tools@latest apps:create IOS <bundle-id>`1. **Link the GoogleService-Info.plist file:** Use the script in the   `xcode-project-setup` skill to obtain the config and link.
references/ios_setup.md:16In the instructionsOpen original file
   `Info.plist` file.1. **Create Firebase Project:** If no project exists, create one:   `npx -y firebase-tools@latest projects:create <project-id> --display-name="My Awesome App"`1. **Create Firebase App:** Register the iOS app with the discovered bundle ID:   `npx -y firebase-tools@latest apps:create IOS <bundle-id>`1. **Link the GoogleService-Info.plist file:** Use the script in the
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

3 instruction sections

This Skill is an Android/iOS setup guide for Firebase Crashlytics. It guides an agent through registering Firebase projects and apps, changing build configuration, and making client crash reports readable through the Firebase CLI MCP server.

View source
SKILL.md:11In the instructionsOpen original file
This skill provides a complete guide for getting started with Crashlytics onAndroid or iOS. Crash data collected from client applications can be read usingthe MCP server in the Firebase CLI.## PrerequisitesProvisioning Crashlytics requires both a Firebase project and a Firebase app,either Android or iOS. To read the data collected by Crashlytics, install theMCP server in the Firebase CLI. See the `firebase-basics` skill for references.

Setup changes Android Gradle files or adds a Crashlytics script that runs during builds of the main iOS target.

View source
references/android_setup.md:24In the instructionsOpen original file
## Add Dependencies to Gradle BuildThese changes are made to your Android project's Gradle files.### Project-level `build.gradle.kts` (`<project>/build.gradle.kts`)Add the latest version of the Crashlytics Gradle plugin to the `plugins` block.Fetch the
references/ios_setup.md:36In the instructionsOpen original file
## Add dSYM Upload ScriptAdd a Run Script phase to the main app target in Xcode. This step is required toupload dSYM files for crash symbolication.1. **Debug Information Format**: The `Debug Information Format` in Build   Settings must be set to `DWARF with dSYM File`.1. **Run Script Content**: A new "Run Script Phase" should be added to the   target's "Build Phases" with the following content:   ```bash   ${BUILD_DIR%/Build/*}/SourcePackages/checkouts/firebase-ios-sdk/Crashlytics/run   ```

The guide makes an intentional startup crash a required installation test. The report is sent to Firebase on the next launch, and the guide instructs removal of the test code after verification.

View source
references/android_setup.md:110In the instructionsOpen original file
### Required: Force a Test CrashTo verify that Crashlytics is correctly installed, you need to force a testcrash in the app.1. Add code to your main activity (e.g., in `onCreate`) to trigger a crash a few   seconds after app startup:   ```kotlin   import android.os.Handler   import android.os.Looper   // ... in your Activity's onCreate method or similar startup logic   Handler(Looper.getMainLooper()).postDelayed({       throw RuntimeException("Test Crash") // Force a crash after 3 seconds   }, 3000)   ```
references/android_setup.md:131In the instructionsOpen original file
1. Restart the app. The Crashlytics SDK will send the crash report to Firebase   on the next app launch.1. After a few minutes, the crash should be available in the Firebase console.   Go to **DevOps & Engagement** > **Crashlytics** to view your dashboard and   crash reports.- If the Firebase MCP server is installed, use the `get_report` tool to check  that a crash was received.- As a fallback, visit the Crashlytics dashboard in the Firebase console to see  the new crash report.5. After verifying that Firebase has received the crash report - either using   the `get_report` tool or manually viewing it in the Firebase console - remove   the code from step 1 that triggers the crash. This prevents the application   from always crashing on start up after a delay.
Start here · InstructionsSKILL.md
firebase-crashlytics
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.

File reference map

References: 2
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records3 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • references/android_setup.mdFull text included
  • references/ios_setup.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • references/android_setup.mdSupporting file
  • references/ios_setup.mdSupporting file

Operations mentioned in code and instructions

Install extra software packages
SKILL.md:4In the instructionsOpen original file
description: Comprehensive guide for Firebase Crashlytics, including provisioning and SDK usage. Use this skill when the user needs help setting up Crashlytics, adding crash reporting, or using the Crashlytics SDK in their application.compatibility: This skill is best used with the Firebase CLI, but does not require it. Firebase CLI can be accessed through `npx -y firebase-tools@latest`.metadata:
references/android_setup.md:16In the instructionsOpen original file
- **Firebase Project**: Created via  `npx -y firebase-tools@latest projects:create` (see `firebase-basics`).- **Firebase App**: Created via
references/android_setup.md:18In the instructionsOpen original file
- **Firebase App**: Created via  `npx -y firebase-tools@latest apps:create <IOS|ANDROID|WEB> <package-name-or-bundle-id>`
Connect to websites
SKILL.md:42In the instructionsOpen original file
- **Android**:  [Customize Crash Reports for Android](https://firebase.google.com/docs/crashlytics/android/customize-crash-reports.md)- **iOS**:
SKILL.md:44In the instructionsOpen original file
- **iOS**:  [Customize Crash Reports for Apple Platforms](https://firebase.google.com/docs/crashlytics/ios/customize-crash-reports.md)
references/android_setup.md:32In the instructionsOpen original file
Fetch the[latest version from the Google Maven repository](https://maven.google.com/web/index.html?q=firebase-crashlytics-gradle#com.google.firebase:firebase-crashlytics-gradle)before adding this.
Run commands
references/ios_setup.md:45In the instructionsOpen original file
   target's "Build Phases" with the following content:   ```bash   ${BUILD_DIR%/Build/*}/SourcePackages/checkouts/firebase-ios-sdk/Crashlytics/run
Lines read
314
File checksum (to compare versions)
4ade61a23bce77087fd9a164cbbe7d570af0dc932d6871db74c5a64e947dba04