Skip to content
skillsafebeta
← Report library
Purpose / Other

Firebase Remote Config Basics Skill Security Audit

What the author says it does (original text)

>-

Independent security check

Security risks found

Files checked
3
Risks found
5
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

Repeated execution of unpinned firebase-tools@latest

Source references: 4
What we found

Template retrieval, deployment, and verification all execute `npx -y firebase-tools@latest`. `latest` changes with registry state and `-y` automatically accepts installation, so the exact executed version is not established by this Skill.

Why this matters

A future defective, compromised, or incompatible release would run with the agent’s permissions and could access Firebase login state, alter workspace files, or operate cloud projects.

Template retrieval, deployment, and version verification all invoke the auto-accepted `firebase-tools@latest` package. Consequently, different tool versions may handle local files and the Firebase project on different runs; the deployment command also changes cloud configuration. Users can require a pinned CLI version and verified package source, and allow deployment only after explicit approval.

SKILL.md:5In the instructionsOpen original file
  Manages Firebase Remote Config templates, feature flags, loading strategies, and SDKs (Android, iOS). Use when downloading/deploying remoteconfig JSON templates, managing version history/feature flags, setting in-app defaults, fetchAndActivate(), real-time listeners, or SDK setup. Don't use for Firebase Hosting, Auth, Firestore, Data Connect, Crashlytics, or App Hosting.compatibility: This skill is best used with the Firebase CLI, but does not require it. Firebase CLI can be accessed through `npx -y firebase-tools@latest`.metadata:
Show 3 other places
SKILL.md:107In the instructionsOpen original file
  - Deploy: Execute the partial deployment command        ```bash    npx -y firebase-tools@latest deploy --only remoteconfig    ```
SKILL.md:82In the instructionsOpen original file
  ```bash  npx -y firebase-tools@latest remoteconfig:get -o remote_config.json  ```
SKILL.md:113In the instructionsOpen original file
- **Verification**: After deployment, verify the update by listing the version  history.  ```bash  npx -y firebase-tools@latest remoteconfig:versions:list  ```
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Remote Config setup additionally introduces Firebase Analytics

Source references: 4
What we found

The Android guide calls Analytics “highly recommended” and adds its dependency alongside Remote Config; the iOS guide likewise directs installation of FirebaseAnalytics. Analytics is not required merely to retrieve basic Remote Config values.

Why this matters

If Analytics is then initialized and enabled, the app may begin sending app-usage, device, or audience-related data to Firebase, expanding data processing and affecting consent and privacy-disclosure obligations.

The Android guide calls Analytics recommended but includes it alongside Remote Config in the dependency example, while the iOS guide directly instructs installation of both packages. This expands dependencies and potentially the app's data-processing scope beyond the stated Remote Config purpose. Users can ask the author to explain its necessity, data behavior, and consent requirements, and to make it explicitly optional.

references/android_setup.md:26In the instructionsOpen original file
These changes are made to your Android project's Gradle files. Google Analyticsis highly recommended as it enables conditional targeting based on userproperties and audiences.
Show 3 other places
references/android_setup.md:59In the instructionsOpen original file
       // Import the Firebase BoM       implementation(platform("com.google.firebase:firebase-bom:32.7.0"))       // Add the dependencies for Remote Config and Analytics       implementation("com.google.firebase:firebase-config-ktx")       implementation("com.google.firebase:firebase-analytics-ktx")   }   ```
references/ios_setup.md:23In the instructionsOpen original file
## Add Swift Package DependenciesInstall the Remote Config and Analytics SDKs using the Swift package manager.Install the `FirebaseRemoteConfig` and `FirebaseAnalytics` packages from the[https://github.com/firebase/firebase-ios-sdk.git](https://github.com/firebase/firebase-ios-sdk.git)repository.
references/android_setup.md:52In the instructionsOpen original file
1. Add the Firebase Remote Config and Analytics dependencies. Using the Firebase   Bill of Materials (BoM) is the best practice for version management.   ```kotlin   dependencies {       // ... other dependencies       // Import the Firebase BoM       implementation(platform("com.google.firebase:firebase-bom:32.7.0"))       // Add the dependencies for Remote Config and Analytics       implementation("com.google.firebase:firebase-config-ktx")       implementation("com.google.firebase:firebase-analytics-ktx")   }   ```
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 3
Medium risk

An existing but incorrect active project is not re-confirmed

Source references: 3
What we found

The project check asks for a Project ID only after a command fails because no active project is selected. The template retrieval and deployment commands contain no explicit `--project`, so an already selected project is not revalidated.

Why this matters

If the Firebase CLI points to another valid project, the agent could download that project’s template and later deploy changes to it, altering feature flags or user experience for a different application.

Project confirmation is triggered only after a command fails because no project is active. If the CLI already has a valid but unintended project selected, this flow does not require it to be checked. The retrieval and deployment commands also omit `--project`, so they may read or change the current active project. Users can require the account and project ID to be displayed first and an explicitly approved `--project` on deployment.

SKILL.md:37In the instructionsOpen original file
If a command fails because "no active project is selected":1. **Check login**: Run `npx -y firebase-tools@latest login:list`.1. **Prompt for ID**: If logged in but no project is active, ask the user:   "Please provide your Firebase Project ID to proceed."1. **Use Flag**: Append `--project <PROJECT_ID>` to every subsequent command.
Show 2 other places
SKILL.md:82In the instructionsOpen original file
  ```bash  npx -y firebase-tools@latest remoteconfig:get -o remote_config.json  ```
SKILL.md:107In the instructionsOpen original file
  - Deploy: Execute the partial deployment command        ```bash    npx -y firebase-tools@latest deploy --only remoteconfig    ```
Medium risk

Cloud projects and apps may be created when resources are missing

Source references: 3
What we found

The platform guides provide `projects:create` and `apps:create` operations when no project or app exists, without a nearby requirement to show the target account, project name, and identifiers and obtain explicit creation approval first.

Why this matters

The agent could register an unwanted or incorrectly named project or app in the logged-in Firebase account, consume project quota, and leave cloud resources the user must manage or remove.

What this evidence establishes

The guide provides cloud-changing commands to create Firebase projects and apps without an explicit confirmation step nearby. However, these can also be read as prerequisite instructions for the user; the source does not clearly direct an agent to run them automatically without consent. The authorization boundary is therefore unclear, rather than proving direct creation. Users can restrict the Skill to inspecting existing resources and require separate approval after showing the account, project ID, display name, and app identifier.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
references/android_setup.md:14In the instructionsOpen original file
- **Firebase CLI**: Installed and logged in (see `firebase-basics`).- **Firebase Project**: Created via  `npx -y firebase-tools@latest projects:create` (see `firebase-basics`).- **Firebase App**: Created via  `npx -y firebase-tools@latest apps:create <IOS|ANDROID|WEB> <package-name-or-bundle-id>`
Show 2 other places
references/ios_setup.md:13In the instructionsOpen original file
1. **Find Bundle ID:** Read the Xcode project to find the iOS bundle ID. Check   the `PRODUCT_BUNDLE_IDENTIFIER` value in the `.pbxproj` file or the   `Info.plist` file.1. **Create Firebase Project:** If no project exists, create one:   `npx -y firebase-tools@latest projects:create <project-id> --display-name="My Awesome App"`1. **Create Firebase App:** Register the iOS app with the discovered bundle ID:   `npx -y firebase-tools@latest apps:create IOS <bundle-id>`1. **Link the GoogleService-Info.plist file:** Use the script in the   `xcode-project-setup` skill to obtain the config and link.
references/ios_setup.md:11In the instructionsOpen original file
Use the `firebase-tools` CLI to set up the project if necessary.1. **Find Bundle ID:** Read the Xcode project to find the iOS bundle ID. Check   the `PRODUCT_BUNDLE_IDENTIFIER` value in the `.pbxproj` file or the   `Info.plist` file.1. **Create Firebase Project:** If no project exists, create one:   `npx -y firebase-tools@latest projects:create <project-id> --display-name="My Awesome App"`1. **Create Firebase App:** Register the iOS app with the discovered bundle ID:   `npx -y firebase-tools@latest apps:create IOS <bundle-id>`1. **Link the GoogleService-Info.plist file:** Use the script in the
Low risk

The install command does not pin a dependency version

Source references: 3
What we found

The installation command does not specify dependency versions. The same command may download different code later, so what you install can differ from what was checked.

Why this matters

A later install may download different code even though the command and this report have not changed.

The compatibility instructions recommend obtaining `firebase-tools@latest` through `npx -y`. `latest` is not version-pinned, while `-y` automatically accepts installation, so the code obtained can change as the registry changes. A user can ask the author to pin and review a specific version, or restrict the Skill to an already approved local Firebase CLI.

SKILL.md:26In the instructionsOpen original file
### Handling npx 403 Forbidden Errors
Show 2 other places
SKILL.md:5In the instructionsOpen original file
  Manages Firebase Remote Config templates, feature flags, loading strategies, and SDKs (Android, iOS). Use when downloading/deploying remoteconfig JSON templates, managing version history/feature flags, setting in-app defaults, fetchAndActivate(), real-time listeners, or SDK setup. Don't use for Firebase Hosting, Auth, Firestore, Data Connect, Crashlytics, or App Hosting.compatibility: This skill is best used with the Firebase CLI, but does not require it. Firebase CLI can be accessed through `npx -y firebase-tools@latest`.metadata:
SKILL.md:28In the instructionsOpen original file
If `npx -y firebase-tools@latest` fails due to registry permissions (403 error):
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

4 instruction sections

The Skill directs the agent to download the current Remote Config template and edit the local JSON directly, but requires it to stop for user review and an explicit “deploy” instruction before publishing.

View source
SKILL.md:79In the instructionsOpen original file
- **Get current template**: Save the remote template to a local JSON file for  auditing or modification.  ```bash  npx -y firebase-tools@latest remoteconfig:get -o remote_config.json  ```- **Autonomous Editing & Discovery** : Modify the local `remote_config.json`  directly. Determine the correct signal (e.g., device.country or percent) and  update the "conditions" array and "parameters" map accordingly.
SKILL.md:90In the instructionsOpen original file
- **MANDATORY: User Review and Verification** : STOP and ask the user to verify  your changes before proceeding to deployment.  - Action: Inform the user: "I have prepared the changes in remote_config.json.    Please review the file for accuracy. Once you are satisfied, tell me to    'deploy' to make the changes live."

After deployment is authorized, the Skill creates firebase.json when absent, maps the local template to Remote Config, performs a Remote-Config-only live deployment, and lists versions for verification.

View source
SKILL.md:97In the instructionsOpen original file
- **Deployment Orchestration** : To push changes, you must ensure the  environment is configured for deployment.  - Config Mapping: If a firebase.json file is missing, create one to map the    local JSON to the Remote Config service:  ```json    { "remoteconfig": { "template": "remote_config.json" } }  ```  - Deploy: Execute the partial deployment command        ```bash    npx -y firebase-tools@latest deploy --only remoteconfig    ```
SKILL.md:113In the instructionsOpen original file
- **Verification**: After deployment, verify the update by listing the version  history.  ```bash  npx -y firebase-tools@latest remoteconfig:versions:list  ```

The Android and iOS guides modify application dependencies and initialization code, then configure defaults and fetchAndActivate so cloud values can affect application UI or logic.

View source
SKILL.md:123In the instructionsOpen original file
- **Set In-App Defaults**: Define baseline values to ensure the app functions  offline or before the first fetch.- **Fetch and Activate**: Retrieve values from the Firebase backend and apply  them to the local UI/Logic.- **Template Management**: Use the Firebase CLI to version-control, get, and  deploy your config JSON files.
references/android_setup.md:83In the instructionsOpen original file
```kotlinval remoteConfig = Firebase.remoteConfigremoteConfig.setDefaultsAsync(R.xml.remote_config_defaults)```````
references/ios_setup.md:77In the instructionsOpen original file
```````swiftremoteConfig.fetchAndActivate { (status, error) in    if status == .successFetchedFromRemote || status == .successUsingPreFetchedData {        print("Config fetched and activated!")    } else {        print("Config not fetched")    }        // Access a value    let message = remoteConfig.configValue(forKey: "welcome_message").stringValue}```
Start here · InstructionsSKILL.md
firebase-remote-config-basics
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.

File reference map

References: 2
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records3 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • references/android_setup.mdFull text included
  • references/ios_setup.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • references/android_setup.mdSupporting file
  • references/ios_setup.mdSupporting file

Operations mentioned in code and instructions

Install extra software packages
SKILL.md:5In the instructionsOpen original file
  Manages Firebase Remote Config templates, feature flags, loading strategies, and SDKs (Android, iOS). Use when downloading/deploying remoteconfig JSON templates, managing version history/feature flags, setting in-app defaults, fetchAndAct …compatibility: This skill is best used with the Firebase CLI, but does not require it. Firebase CLI can be accessed through `npx -y firebase-tools@latest`.metadata:
SKILL.md:26In the instructionsOpen original file
### Handling npx 403 Forbidden Errors
SKILL.md:28In the instructionsOpen original file
If `npx -y firebase-tools@latest` fails due to registry permissions (403 error):
Connect to websites
SKILL.md:61In the instructionsOpen original file
patterns (see[Loading Strategies](https://firebase.google.com/docs/remote-config/loading)):
references/ios_setup.md:28In the instructionsOpen original file
Install the `FirebaseRemoteConfig` and `FirebaseAnalytics` packages from the[https://github.com/firebase/firebase-ios-sdk.git](https://github.com/firebase/firebase-ios-sdk.git)repository.
references/ios_setup.md:49In the instructionsOpen original file
<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><plist version="1.0">
Run commands
SKILL.md:82In the instructionsOpen original file
  ```bash  npx -y firebase-tools@latest remoteconfig:get -o remote_config.json
SKILL.md:109In the instructionsOpen original file
        ```bash    npx -y firebase-tools@latest deploy --only remoteconfig
SKILL.md:116In the instructionsOpen original file
  ```bash  npx -y firebase-tools@latest remoteconfig:versions:list
Lines read
311
File checksum (to compare versions)
ee610fa0984ed0d02f80a38be040161e658ef5e0659c665d3728559164df7990