跳转到正文
报告库
用途分类 / 其他用途

Firebase Basics Skill 安全审计

作者说它能做什么(原文)

>-

第三方安全检查结论

先别安装或运行

已检查文件
20
发现的风险
5
会不会运行危险命令?检查是否下载程序后直接运行、让他人远程控制电脑,或藏起要运行的命令。发现 1 项风险
高风险

每次调用都可自动下载并执行未固定版本的 npm 包

原文依据:2 处
发现了什么

说明强制使用 `npx -y firebase-tools@latest`。`@latest` 不固定经过审查的版本,`-y` 自动接受安装;因此即使只是查询版本,也可能从包源下载并执行新代码。登录后运行时,该代码还处于可访问 Firebase 凭据的环境中。

为什么需要注意

若上游包、发布账户或依赖链被入侵,恶意代码可能读取本机文件或会话凭据,并以当前用户权限执行。提供的证据不表示这种入侵已经发生。

来源支持这一风险:该技能强制使用带 `-y` 的 `@latest` 包,而登录步骤会在同一环境中建立 Firebase 身份。随后运行未固定版本的 CLI 时,它可能接触本地登录状态及获准的 Firebase 项目。这里没有证据证明凭据已被滥用;风险条件是用户实际执行这些命令。用户可固定版本,并用低权限账号或隔离环境运行。

SKILL.md:82来自说明文档打开原文件
1. **Use npx for CLI commands:** To ensure you always use the latest version of   the Firebase CLI, always prepend commands with `npx -y firebase-tools@latest`   instead of just `firebase`. For example, use   `npx -y firebase-tools@latest --version`. NEVER suggest the naked `firebase`   command as an alternative.1. **Prioritize official knowledge:** For any Firebase-related knowledge,
查看另外 1 个位置
SKILL.md:40来自说明文档打开原文件
1. **Authentication:** Ensure you are logged in to Firebase so that commands   have the correct permissions. Run `npx -y firebase-tools@latest login`. For   environments without a browser (e.g., remote shells), use   `npx -y firebase-tools@latest login --no-localhost`.   - The command should output the current user.   - If you are not logged in, follow the interactive instructions from this     command to authenticate.
会不会泄露文件和密钥?检查是否发送含密码或密钥的文件,以及代码里是否直接写了密钥。未发现风险
会不会删除文件或一直在后台运行?检查是否大范围删除文件、改写磁盘,或设置自动启动。未发现风险
会不会绕过安全保护?检查是否跳过网站安全验证、开放过多文件权限,或取消操作前的确认。发现 3 项风险
高风险

狭窄的基础任务会安装持久 MCP 服务,使代理可直接操作 Firebase 项目

原文依据:5 处
发现了什么

设置指南要求把一个自动运行 `firebase-tools@latest mcp` 的服务器写入代理配置;文档称它可以直接与 Firebase 项目交互。该持久扩展明显宽于登录、项目选择和配置下载的声明范围。

为什么需要注意

重启代理后,Firebase MCP 会持续可用。若代理会话被误导、项目选错或其他提示不可信,它可能借已登录身份对远程项目执行超出用户当前请求的操作。证据没有列出 MCP 的具体权限,因此不能断言所有 Firebase 操作均可用。

本技能自称只处理登录、项目和配置下载,却强制阅读环境设置并要求完整安装。Cursor 指南会把一个长期保存在用户级或项目级配置中的 MCP 服务器加入代理;该服务器通过未固定版本的 Firebase CLI 启动,并被描述为可直接操作 Firebase 项目。风险发生在用户允许修改配置并重启 Cursor 后。用户可拒绝 MCP 安装、仅用项目级配置,并限制 Firebase 账号权限。

references/setup/cursor.md:30来自说明文档打开原文件
### 2. Configure and Verify Firebase MCP ServerThe MCP server allows Cursor to interact directly with Firebase projects.1. **Locate `mcp.json`**: Find the configuration file for your operating system:   - Global: `~/.cursor/mcp.json`   - Project: `.cursor/mcp.json`   *Note: If the directory or `mcp.json` file does not exist, create them and   initialize the file with `{ "mcpServers": {} }` before proceeding.*
查看另外 4 个位置
references/setup/cursor.md:68来自说明文档打开原文件
1. **Add or Update Configuration**: If the `firebase` block is missing or   incorrect, add it to the `mcpServers` object:   ```json   "firebase": {     "command": "npx",     "args": [       "-y",       "firebase-tools@latest",       "mcp"     ]   }   ```   *CRITICAL: Merge this configuration into the existing `mcp.json` file. You   MUST preserve any other existing servers inside the `mcpServers` object.*1. **Verify Configuration**: Save the file and confirm the `firebase` block is   present and properly formatted JSON.
references/setup/cursor.md:88来自说明文档打开原文件
### 3. Restart and Verify Connection1. **Restart Cursor**: Instruct the user to restart the Cursor application.   **Stop and wait** for their confirmation before proceeding.1. **Confirm Connection**: Check the MCP server list in the Cursor UI to confirm   that the Firebase MCP server is connected.
SKILL.md:95来自说明文档打开原文件
   instead of relying on general knowledge.1. **Use Firebase MCP Server tools instead of direct API calls:** Whenever you   need to interact with remote Firebase APIs (such as fetching Crashlytics logs   or executing Data Connect queries), use the tools provided by the Firebase   MCP Server instead of attempting manual API calls.1. **Keep Plugin / Agent Skills updated:** Since Firebase best practices evolve
SKILL.md:19来自说明文档打开原文件
   - Verify if the Firebase MCP server is installed using your existing tools.   - **CRITICAL**: Before configuring any extensions or agent environments     below, you MUST read     [references/local-env-setup.md](references/local-env-setup.md).   - **DO NOT SKIP** this step: if 'firebase-basics' is the only Firebase skill     available to you, you must follow the reference for your agent environment     to set up the full suite of Firebase skills:     - **Gemini CLI**: Review
中风险

基础操作会触发整套第三方代理技能的通配安装或全局更新

原文依据:5 处
发现了什么

如果只有本技能,说明要求安装完整 Firebase 技能套件;多个指南使用 `--skill "*" --yes`,刷新指南还可用 `--global --yes` 更新全部已安装技能。这扩大了代理随后会遵循的指令集合,并可能修改用户级代理环境。

为什么需要注意

新增或更新的技能可以改变代理未来处理任务的方式,且范围不限于本技能声明的基础 Firebase 操作。全局安装会影响其他项目;自动确认和动态版本也减少用户逐项审查机会。

主指令明确要求在只有本技能时设置完整 Firebase 技能套件。Android Studio 指南用通配符和 `--yes` 安装全部技能;刷新指南还提供带 `--global --yes` 的全局更新命令。执行后会持久修改代理可用的指令集合,且范围远超基础 Firebase 操作。用户可要求列出并逐个批准技能、固定来源版本、使用项目级安装,并拒绝无关的全局更新。

SKILL.md:22来自说明文档打开原文件
     [references/local-env-setup.md](references/local-env-setup.md).   - **DO NOT SKIP** this step: if 'firebase-basics' is the only Firebase skill     available to you, you must follow the reference for your agent environment     to set up the full suite of Firebase skills:     - **Gemini CLI**: Review
查看另外 4 个位置
references/setup/android_studio.md:8来自说明文档打开原文件
Gemini in Android Studio expects skills to be located at `~/.agents/skills`.To install all Firebase skills, run the following command in your terminal:```bashnpx -y skills add firebase/agent-skills --skill "*" --yes```Ensure that the skills are installed or linked to the `~/.agents/skills`directory.
references/refresh/other-agents.md:58来自说明文档打开原文件
1. **Update Existing Skills:** Update all currently installed skills to their   latest versions:   ```bash   # Update project-level skills   npx -y skills update --agent <AGENT_NAME> --yes   # Update global-level skills   npx -y skills update --agent <AGENT_NAME> --global --yes   ```
references/setup/other_agents.md:6来自说明文档打开原文件
## Recommended: Global SetupThe agent skills and MCP server should be installed globally for consistentaccess across projects.
SKILL.md:19来自说明文档打开原文件
   - Verify if the Firebase MCP server is installed using your existing tools.   - **CRITICAL**: Before configuring any extensions or agent environments     below, you MUST read     [references/local-env-setup.md](references/local-env-setup.md).   - **DO NOT SKIP** this step: if 'firebase-basics' is the only Firebase skill     available to you, you must follow the reference for your agent environment     to set up the full suite of Firebase skills:     - **Gemini CLI**: Review
低风险

安装命令没有固定依赖版本

原文依据:3 处
发现了什么

安装命令没有指定依赖版本。同样的命令以后可能下载不同代码,你实际安装的内容可能与这次检查时不同。

为什么需要注意

即使命令和报告没变,以后安装时也可能下载到另一份代码。

该技能明确要求始终通过 `npx -y` 运行 `firebase-tools@latest`,包括仅检查版本时。`latest` 会随时间变化,`-y` 会跳过安装确认,因此包源中的新版本代码可能在用户环境中执行。用户可要求作者固定并审核具体版本,或限制 npm 网络访问及命令权限。

在使用 Genkit 的条件下,文档让用户通过 `npx skills add` 安装仓库中的技能,但没有固定提交或版本。以后执行同一命令可能取得不同内容,并把新指令加入代理环境。用户可要求固定可信提交、先审查待安装文件,并限定为项目级安装。

SKILL.md:82来自说明文档打开原文件
1. **Use npx for CLI commands:** To ensure you always use the latest version of   the Firebase CLI, always prepend commands with `npx -y firebase-tools@latest`   instead of just `firebase`. For example, use   `npx -y firebase-tools@latest --version`. NEVER suggest the naked `firebase`   command as an alternative.1. **Prioritize official knowledge:** For any Firebase-related knowledge,
查看另外 2 个位置
SKILL.md:147来自说明文档打开原文件
  ```bash  npx skills add genkit-ai/skills  ```
SKILL.md:142来自说明文档打开原文件
- **Login Issues:** If the browser fails to open during the login step, use  `npx -y firebase-tools@latest login --no-localhost` instead.- **Genkit:** If using Genkit, install the skills:    ```bash  npx skills add genkit-ai/skills  ```
会不会误导 AI 或隐藏内容?检查工作说明是否要求 AI 忽略你的指令、干扰检查结果,或夹带看不见的文字。发现 1 项风险
中风险

技能宣称只做基础操作,却引导初始化及使用明确排除的 Firebase 服务

原文依据:5 处
发现了什么

主描述禁止将本技能用于 Hosting、Firestore 和 Auth,但其引用的初始化流程会选择 Firestore、Functions、Hosting,Web 指南还初始化 Auth 并读取 Firestore。代理可能把这些引用当作当前技能的实施指令。

为什么需要注意

用户只要求登录、切换项目或下载配置时,代理可能扩大任务,创建配置文件、安装 SDK,或开始配置/访问云服务。这会改变代码库,并可能影响远程项目或后续费用与数据访问。

存在明确的范围冲突。描述禁止把本技能用于 Hosting、Firestore 和 Auth,但主文件又指向服务初始化指南;该指南主动让代理选择 Firestore、Functions、Hosting。被引用的 Web 指南还初始化 Auth 并读取 Firestore。若代理按这些引用继续执行,可能对代码、依赖和云项目作出超出用户基础设置请求的更改。用户可要求只批准逐项列出的基础命令,并禁止服务初始化。

SKILL.md:4来自说明文档打开原文件
description: >-  Provides foundational Firebase CLI setup, CLI installation, version checks (`firebase-tools@latest --version`), CLI login (including --no-localhost), project creation, project selection (`firebase use`), and app config file downloads (`google-services.json`, `GoogleService-Info.plist`). Use ONLY for CLI login, project creation/switching, or downloading app config files. Don't use for Firebase Hosting deploy, Firestore, Auth, App Hosting, Data Connect, Crashlytics, or Remote Config.metadata:
查看另外 4 个位置
SKILL.md:127来自说明文档打开原文件
# References- **Initialize Firebase:** See  [references/firebase-service-init.md](references/firebase-service-init.md)  when you need to initialize new Firebase services using the CLI.- **Exploring Commands:** See  [references/firebase-cli-guide.md](references/firebase-cli-guide.md) to  discover and understand CLI functionality.- **SDK Setup:** For detailed guides on adding Firebase to your app:  - **Web**: See [references/web_setup.md](references/web_setup.md)  - **Android**: See [references/android_setup.md](references/android_setup.md)  - **iOS**: See [references/ios_setup.md](references/ios_setup.md)
references/firebase-service-init.md:10来自说明文档打开原文件
1. **Initialize Services:** Run the initialization command:   ```bash   npx -y firebase-tools@latest init   ```The CLI will guide you through:- Selecting features (Firestore, Functions, Hosting, etc.).- Associating with an existing project or creating a new one.- Configuring files (e.g. `firebase.json`, `.firebaserc`).
references/web_setup.md:63来自说明文档打开原文件
Import specific services as needed (Modular API):```javascriptimport { getFirestore, collection, getDocs } from "firebase/firestore";import { app } from "./firebase"; // Import the initialized appconst db = getFirestore(app);async function getUsers() {  const querySnapshot = await getDocs(collection(db, "users"));  querySnapshot.forEach((doc) => {    console.log(`${doc.id} => ${doc.data()}`);  });}
SKILL.md:2来自说明文档打开原文件
---name: firebase-basicsdescription: >-  Provides foundational Firebase CLI setup, CLI installation, version checks (`firebase-tools@latest --version`), CLI login (including --no-localhost), project creation, project selection (`firebase use`), and app config file downloads (`google-services.json`, `GoogleService-Info.plist`). Use ONLY for CLI login, project creation/switching, or downloading app config files. Don't use for Firebase Hosting deploy, Firestore, Auth, App Hosting, Data Connect, Crashlytics, or Remote Config.metadata:
会不会偷偷改推广链接或收款方?检查是否强制替换推广链接或收款对象,同时要求隐瞒更改。未发现风险

Skill 逻辑拆解

3 个说明模块

该技能自称仅用于 Firebase CLI 登录、项目创建/切换和应用配置下载,并明确排除部署、Firestore、Auth 等功能。

查看原文
SKILL.md:4来自说明文档打开原文件
description: >-  Provides foundational Firebase CLI setup, CLI installation, version checks (`firebase-tools@latest --version`), CLI login (including --no-localhost), project creation, project selection (`firebase use`), and app config file downloads (`google-services.json`, `GoogleService-Info.plist`). Use ONLY for CLI login, project creation/switching, or downloading app config files. Don't use for Firebase Hosting deploy, Firestore, Auth, App Hosting, Data Connect, Crashlytics, or Remote Config.metadata:

在选择或创建 Firebase 项目前,主说明要求暂停并征求用户选择;现有活动项目也应由用户确认。

查看原文
SKILL.md:51来自说明文档打开原文件
   > [!IMPORTANT] **For Agents:** Before proceeding with project configuration,   > you MUST pause and ask the developer if they prefer to:   >   > 1. **Provide an existing Firebase Project ID**, or   > 1. **Create a new Firebase project**.
SKILL.md:59来自说明文档打开原文件
     1. Check the current project by running `npx -y firebase-tools@latest use`.     1. If the command outputs `Active Project: <project-id>`, confirm with the        user if this is the intended project.     1. If not, or if no project is active, set the project provided by the

该技能要求登录 Firebase,并通过 CLI 获取 Android/iOS 应用配置并保存到项目中。

查看原文
SKILL.md:40来自说明文档打开原文件
1. **Authentication:** Ensure you are logged in to Firebase so that commands   have the correct permissions. Run `npx -y firebase-tools@latest login`. For   environments without a browser (e.g., remote shells), use   `npx -y firebase-tools@latest login --no-localhost`.   - The command should output the current user.   - If you are not logged in, follow the interactive instructions from this     command to authenticate.
SKILL.md:115来自说明文档打开原文件
     [references/refresh/other-agents.md](references/refresh/other-agents.md)1. **Automate Config File Retrieval:** When setting up iOS or Android apps, do   NOT direct users to the Firebase Console to download `google-services.json`   or `GoogleService-Info.plist`. Instead, use the Firebase CLI to fetch the   config programmatically:   - For Android:     `npx -y firebase-tools@latest apps:sdkconfig ANDROID <APP_ID> --project <PROJECT_ID>`   - For iOS:     `npx -y firebase-tools@latest apps:sdkconfig IOS <APP_ID> --project <PROJECT_ID>`     Save the output to the appropriate location (e.g.,     `app/google-services.json` for Android, or a path to be linked by     `xcode-project-setup` for iOS).

主流程把安装完整 Firebase 技能套件及 MCP 服务器作为前置条件,而不是只提供本技能声明的基础功能。

查看原文
SKILL.md:18来自说明文档打开原文件
     is installed.   - Verify if the Firebase MCP server is installed using your existing tools.   - **CRITICAL**: Before configuring any extensions or agent environments     below, you MUST read     [references/local-env-setup.md](references/local-env-setup.md).   - **DO NOT SKIP** this step: if 'firebase-basics' is the only Firebase skill     available to you, you must follow the reference for your agent environment     to set up the full suite of Firebase skills:     - **Gemini CLI**: Review
references/local-env-setup.md:71来自说明文档打开原文件
## 4. Install Agent Skills and MCP ServerTo fully manage Firebase, the agent needs specific skills and the Firebase MCPserver installed. Refer to the main `SKILL.md` for direct links to theinstallation instructions specific to your agent environment.______________________________________________________________________**CRITICAL AGENT RULE:** Do NOT proceed with any other Firebase tasks untilEVERY step above has been successfully verified and completed.
从这里开始 · 工作说明SKILL.md
firebase-basics
连线表示工作说明包含的模块,不是实际运行顺序。点击模块可查看原文。

文件引用关系图

18 处引用
哪些文件发起引用引用了什么
连线表示真实的文件引用,不是运行顺序。点击节点可高亮相关连线,并查看具体文件和原文位置。虚线表示还有文件需要定位。
文件与检查记录20 个文件

检查范围与遗漏

逐文件查看涉及的内容

下方列出本次涉及的原文范围;纳入检查不代表已查清所有问题。

  • SKILL.md已纳入全文
  • references/android_setup.md已纳入全文
  • references/firebase-cli-guide.md已纳入全文
  • references/firebase-service-init.md已纳入全文
  • references/ios_setup.md已纳入全文
  • references/local-env-setup.md已纳入全文
  • references/refresh/android_studio.md已纳入全文
  • references/refresh/antigravity.md已纳入全文
  • references/refresh/claude.md已纳入全文
  • references/refresh/gemini-cli.md已纳入全文
  • references/refresh/other-agents.md已纳入全文
  • references/setup/android_studio.md已纳入全文
  • references/setup/antigravity.md已纳入全文
  • references/setup/claude_code.md已纳入全文
  • references/setup/cursor.md已纳入全文
  • references/setup/gemini_cli.md已纳入全文
  • references/setup/github_copilot.md已纳入全文
  • references/setup/other_agents.md已纳入全文
  • references/web_setup.md已纳入全文
  • references/flutter_setup.md已纳入全文

这份报告只针对上方版本。我们看了拿到的代码和说明文件,没有实际运行 Skill,也没有检查它另外安装的软件包。因此,这不是“保证安全”的承诺;换了版本或使用环境,结果也可能不同。

  • SKILL.md工作说明
  • references/android_setup.md配套文件
  • references/firebase-cli-guide.md配套文件
  • references/firebase-service-init.md配套文件
  • references/flutter_setup.md配套文件
  • references/ios_setup.md配套文件
  • references/local-env-setup.md配套文件
  • references/refresh/android_studio.md配套文件
  • references/refresh/antigravity.md配套文件
  • references/refresh/claude.md配套文件
  • references/refresh/gemini-cli.md配套文件
  • references/refresh/other-agents.md配套文件
  • references/setup/android_studio.md配套文件
  • references/setup/antigravity.md配套文件
  • references/setup/claude_code.md配套文件
  • references/setup/cursor.md配套文件
  • references/setup/gemini_cli.md配套文件
  • references/setup/github_copilot.md配套文件
  • references/setup/other_agents.md配套文件
  • references/web_setup.md配套文件

代码和说明中提到的操作

安装其他软件包
SKILL.md:16来自说明文档打开原文件
   - Run `npx -y firebase-tools@latest --version` to check if the Firebase CLI     is installed.
SKILL.md:41来自说明文档打开原文件
1. **Authentication:** Ensure you are logged in to Firebase so that commands   have the correct permissions. Run `npx -y firebase-tools@latest login`. For   environments without a browser (e.g., remote shells), use
SKILL.md:43来自说明文档打开原文件
   environments without a browser (e.g., remote shells), use   `npx -y firebase-tools@latest login --no-localhost`.
运行命令
SKILL.md:65来自说明文档打开原文件
                ```bash        npx -y firebase-tools@latest use <PROJECT_ID>
SKILL.md:71来自说明文档打开原文件
     ```bash     npx -y firebase-tools@latest projects:create <project-id> --display-name "<display-name>"
SKILL.md:146来自说明文档打开原文件
    ```bash  npx skills add genkit-ai/skills
连接外部网站
references/flutter_setup.md:15来自说明文档打开原文件
   1. **Download SDK**: Fetch the latest stable SDK from the      [Flutter Archive](https://docs.flutter.dev/install/archive?tab=macos).   1. **Extract**: Unzip the SDK to a permanent directory (e.g.,
references/ios_setup.md:61来自说明文档打开原文件
> Firebase iOS SDK at> [https://github.com/firebase/firebase-ios-sdk/releases](https://github.com/firebase/firebase-ios-sdk/releases)> and use that version when adding the SPM dependency.
references/local-env-setup.md:20来自说明文档打开原文件
  1. Guide the user to the     [official nvm repository](https://github.com/nvm-sh/nvm#installing-and-updating).  1. Request the user to manually install `nvm` and reply when finished. **Stop
读取密钥或账号配置
references/web_setup.md:45来自说明文档打开原文件
const firebaseConfig = {  apiKey: "API_KEY",  authDomain: "PROJECT_ID.firebaseapp.com",
读取了多少行
1,372
文件校验值(用于核对版本)
edbe6d0cf356ef129f7d5b45a8dc199f9e4b07386c6af9ce0b1371a77a2e3a50