跳转到正文
skillsafebeta
← 报告库
用途分类 / 其他用途

Firebase Crashlytics Skill 安全审计

作者说它能做什么（原文）

Comprehensive guide for Firebase Crashlytics, including provisioning and SDK usage. Use this skill when the user needs help setting up Crashlytics, adding crash reporting, or using the Crashlytics SDK in their application.

第三方安全检查结论

发现安全风险

已检查文件
3
发现的风险
5
会不会运行危险命令？检查是否下载程序后直接运行、让他人远程控制电脑，或藏起要运行的命令。发现 1 项风险
中风险

命令会直接下载并运行未固定版本的 Firebase CLI

原文依据：2 处
发现了什么

指南多次使用 `npx -y firebase-tools@latest`。`-y` 自动接受安装，而 `latest` 会随发布时间变化，因此未来执行的代码并非本次审计中可确定的固定版本。

为什么需要注意

如果 npm 包、其依赖或最新版本出现恶意或破坏性变化，它会以运行该代理的用户权限执行，并可接触当前项目文件及已登录的 Firebase 会话。

这是操作指南，不会仅因被读取而执行命令；但若代理按指南操作，`npx -y` 会自动同意安装并运行当时由 `latest` 指向的 Firebase CLI。版本未固定，实际执行内容会随发布变化，增加供应链和不可复现风险。用户可要求固定并审核具体版本，或限制安装及网络权限。

SKILL.md:4来自说明文档打开原文件
description: Comprehensive guide for Firebase Crashlytics, including provisioning and SDK usage. Use this skill when the user needs help setting up Crashlytics, adding crash reporting, or using the Crashlytics SDK in their application.compatibility: This skill is best used with the Firebase CLI, but does not require it. Firebase CLI can be accessed through `npx -y firebase-tools@latest`.metadata:
查看另外 1 个位置
references/android_setup.md:14来自说明文档打开原文件
- **Firebase CLI**: Installed and logged in (see `firebase-basics`).- **Firebase Project**: Created via  `npx -y firebase-tools@latest projects:create` (see `firebase-basics`).- **Firebase App**: Created via  `npx -y firebase-tools@latest apps:create <IOS|ANDROID|WEB> <package-name-or-bundle-id>`
会不会泄露文件和密钥？检查是否发送含密码或密钥的文件，以及代码里是否直接写了密钥。发现 2 项风险
中风险

崩溃报告及可选用户标识会被发送到 Firebase

原文依据：3 处
发现了什么

Skill 明确说明客户端崩溃数据由 Crashlytics 收集，并提供自定义日志、键值和用户标识功能；测试流程确认报告会在下次启动时上传。

为什么需要注意

崩溃上下文、日志或用户标识若包含个人信息、令牌、请求内容或业务数据，就会离开设备并出现在 Firebase 项目及可读取该项目的 MCP/控制台中。

Crashlytics 的目的确实是从客户端收集并向 Firebase 发送崩溃数据；测试报告会在应用下次启动时上传。自定义键、日志和用户标识只是列出的可选能力，并非这份指南自动添加，但启用后可能把个人信息或敏感调试内容带入报告。用户可要求说明收集字段、避免直接身份标识和秘密信息，并限制 Firebase 项目访问及数据保留。

SKILL.md:11来自说明文档打开原文件
This skill provides a complete guide for getting started with Crashlytics onAndroid or iOS. Crash data collected from client applications can be read usingthe MCP server in the Firebase CLI.
查看另外 2 个位置
SKILL.md:31来自说明文档打开原文件
The SDK provides a number of features to make crash reports more actionable.- Add custom keys- Add custom logs- Set user identifiers- Report non-fatal exceptions
references/android_setup.md:131来自说明文档打开原文件
1. Restart the app. The Crashlytics SDK will send the crash report to Firebase   on the next app launch.1. After a few minutes, the crash should be available in the Firebase console.   Go to **DevOps & Engagement** > **Crashlytics** to view your dashboard and   crash reports.- If the Firebase MCP server is installed, use the `get_report` tool to check  that a crash was received.- As a fallback, visit the Crashlytics dashboard in the Firebase console to see
中风险

构建过程会把原生符号文件或 iOS dSYM 上传到 Crashlytics

原文依据：2 处
发现了什么

Android 配置可自动上传原生符号，iOS 配置要求在主目标中加入 Crashlytics 的 dSYM 上传脚本。此上传会在后续构建过程中持续发生，而不只是发送一次测试崩溃。

为什么需要注意

符号文件会向 Firebase 项目披露内部类、函数或构建结构等专有实现元数据；项目访问控制不当会扩大可读取这些资料的人员范围。

在相应配置启用并执行构建时，Android 的可选设置会自动上传原生符号；iOS 指南则要求在主目标中加入 Crashlytics 脚本上传 dSYM。符号文件通常用于还原崩溃堆栈，但仍会把构建产物发送给 Firebase，并可能持续作用于后续构建。用户可要求确认上传目标、构建类型和保留策略，并仅向批准的 Firebase 项目上传。

references/android_setup.md:89来自说明文档打开原文件
1. Enable the `nativeSymbolUpload` flag in your `buildTypes` configuration. This   will automatically upload symbol files for your native code, which are   required to symbolicate native crash reports.   ```kotlin   android {       // ... other config       buildTypes {           getByName("release") {               // ...               firebaseCrashlytics {                   nativeSymbolUploadEnabled = true               }           }
查看另外 1 个位置
references/ios_setup.md:36来自说明文档打开原文件
## Add dSYM Upload ScriptAdd a Run Script phase to the main app target in Xcode. This step is required toupload dSYM files for crash symbolication.1. **Debug Information Format**: The `Debug Information Format` in Build   Settings must be set to `DWARF with dSYM File`.1. **Run Script Content**: A new "Run Script Phase" should be added to the   target's "Build Phases" with the following content:   ```bash   ${BUILD_DIR%/Build/*}/SourcePackages/checkouts/firebase-ios-sdk/Crashlytics/run   ```
会不会删除文件或一直在后台运行？检查是否大范围删除文件、改写磁盘，或设置自动启动。发现 1 项风险
中风险

必需的测试步骤会把启动即崩溃的代码写入应用

原文依据：5 处
发现了什么

Android 和 iOS 指南都要求在应用启动路径中加入延时抛出异常或 `fatalError` 的代码。指南虽要求验证后删除，但删除发生在后续人工步骤。

为什么需要注意

如果测试代码被提交、构建或发布前没有清除，应用会在每次启动约三秒后崩溃，导致测试、演示或生产版本无法使用。

Android 和 iOS 指南都把强制崩溃列为“必需”验证步骤，并要求把异常放在应用启动路径中。若在普通开发、测试或发布构建中运行，应用会在约三秒后退出，可能中断使用；遗忘删除时会持续发生。指南确实要求验证后删除，因此风险是有意但依赖后续人工清理。用户可只允许在隔离的调试构建或测试设备上启用，并在发布前验证代码已移除。

references/android_setup.md:115来自说明文档打开原文件
1. Add code to your main activity (e.g., in `onCreate`) to trigger a crash a few   seconds after app startup:   ```kotlin   import android.os.Handler   import android.os.Looper   // ... in your Activity's onCreate method or similar startup logic   Handler(Looper.getMainLooper()).postDelayed({       throw RuntimeException("Test Crash") // Force a crash after 3 seconds   }, 3000)   ```
查看另外 4 个位置
references/android_setup.md:143来自说明文档打开原文件
5. After verifying that Firebase has received the crash report - either using   the `get_report` tool or manually viewing it in the Firebase console - remove   the code from step 1 that triggers the crash. This prevents the application   from always crashing on start up after a delay.
references/ios_setup.md:76来自说明文档打开原文件
class AppDelegate: NSObject, UIApplicationDelegate {  func application(_ application: UIApplication,                   didFinishLaunchingWithOptions launchOptions: [UIApplication.LaunchOptionsKey : Any]? = nil) -> Bool {    FirebaseApp.configure()    // Force a crash after a delay to test Crashlytics    DispatchQueue.main.asyncAfter(deadline: .now() + 3) {        fatalError("Test Crash")    }    return true  }}```
references/ios_setup.md:106来自说明文档打开原文件
5. After verifying that Firebase has received the crash report - either using   the `get_report` tool or manually viewing it in the Firebase console - remove   the code from step 1 that triggers the crash. This prevents the application   from always crashing on start up after a delay.
references/android_setup.md:110来自说明文档打开原文件
### Required: Force a Test CrashTo verify that Crashlytics is correctly installed, you need to force a testcrash in the app.1. Add code to your main activity (e.g., in `onCreate`) to trigger a crash a few   seconds after app startup:   ```kotlin   import android.os.Handler   import android.os.Looper   // ... in your Activity's onCreate method or similar startup logic   Handler(Looper.getMainLooper()).postDelayed({       throw RuntimeException("Test Crash") // Force a crash after 3 seconds   }, 3000)   ```
会不会绕过安全保护？检查是否跳过网站安全验证、开放过多文件权限，或取消操作前的确认。发现 1 项风险
中风险

指南可在当前已登录的 Firebase 账户中创建云项目和应用

原文依据：3 处
发现了什么

当本地配置不存在时，指南允许直接调用 CLI 创建 Firebase 项目和应用，但所示步骤没有先核对当前登录账户、组织、目标项目或征求逐项确认。

为什么需要注意

代理可能在错误的个人或公司账户中留下未经预期的云资源、应用注册及相关权限配置。

若没有现有配置，指南允许在当前已登录的 Firebase 账户中创建项目和应用，这是会改变云账户状态的真实操作。所示命令没有指定或核对登录身份、组织/计费归属，也没有明确的逐项确认步骤，因此代理可能在错误账户下创建资源。用户可要求执行前显示当前身份、目标项目、组织和预计费用，并单独批准创建。

references/android_setup.md:10来自说明文档打开原文件
Before you begin, ensure you have the following. If a `google-services.json`file is present, then use that Firebase project and app. Otherwise you may needto create them.- **Firebase CLI**: Installed and logged in (see `firebase-basics`).- **Firebase Project**: Created via  `npx -y firebase-tools@latest projects:create` (see `firebase-basics`).- **Firebase App**: Created via  `npx -y firebase-tools@latest apps:create <IOS|ANDROID|WEB> <package-name-or-bundle-id>`
查看另外 2 个位置
references/ios_setup.md:11来自说明文档打开原文件
Use the `firebase-tools` CLI to set up the project if necessary.1. **Find Bundle ID:** Read the Xcode project to find the iOS bundle ID. Check   the `PRODUCT_BUNDLE_IDENTIFIER` value in the `.pbxproj` file or the   `Info.plist` file.1. **Create Firebase Project:** If no project exists, create one:   `npx -y firebase-tools@latest projects:create <project-id> --display-name="My Awesome App"`1. **Create Firebase App:** Register the iOS app with the discovered bundle ID:   `npx -y firebase-tools@latest apps:create IOS <bundle-id>`1. **Link the GoogleService-Info.plist file:** Use the script in the   `xcode-project-setup` skill to obtain the config and link.
references/ios_setup.md:16来自说明文档打开原文件
   `Info.plist` file.1. **Create Firebase Project:** If no project exists, create one:   `npx -y firebase-tools@latest projects:create <project-id> --display-name="My Awesome App"`1. **Create Firebase App:** Register the iOS app with the discovered bundle ID:   `npx -y firebase-tools@latest apps:create IOS <bundle-id>`1. **Link the GoogleService-Info.plist file:** Use the script in the
会不会误导 AI 或隐藏内容？检查工作说明是否要求 AI 忽略你的指令、干扰检查结果，或夹带看不见的文字。未发现风险
会不会偷偷改推广链接或收款方？检查是否强制替换推广链接或收款对象，同时要求隐瞒更改。未发现风险

Skill 逻辑拆解

3 个说明模块

该 Skill 是 Firebase Crashlytics 的 Android/iOS 配置指南。它引导代理注册 Firebase 项目和应用、修改构建配置，并使客户端崩溃报告可通过 Firebase CLI 的 MCP 服务读取。

查看原文
SKILL.md:11来自说明文档打开原文件
This skill provides a complete guide for getting started with Crashlytics onAndroid or iOS. Crash data collected from client applications can be read usingthe MCP server in the Firebase CLI.## PrerequisitesProvisioning Crashlytics requires both a Firebase project and a Firebase app,either Android or iOS. To read the data collected by Crashlytics, install theMCP server in the Firebase CLI. See the `firebase-basics` skill for references.

配置过程会修改 Android Gradle 文件，或在 iOS 主目标中增加构建时运行的 Crashlytics 脚本。

查看原文
references/android_setup.md:24来自说明文档打开原文件
## Add Dependencies to Gradle BuildThese changes are made to your Android project's Gradle files.### Project-level `build.gradle.kts` (`<project>/build.gradle.kts`)Add the latest version of the Crashlytics Gradle plugin to the `plugins` block.Fetch the
references/ios_setup.md:36来自说明文档打开原文件
## Add dSYM Upload ScriptAdd a Run Script phase to the main app target in Xcode. This step is required toupload dSYM files for crash symbolication.1. **Debug Information Format**: The `Debug Information Format` in Build   Settings must be set to `DWARF with dSYM File`.1. **Run Script Content**: A new "Run Script Phase" should be added to the   target's "Build Phases" with the following content:   ```bash   ${BUILD_DIR%/Build/*}/SourcePackages/checkouts/firebase-ios-sdk/Crashlytics/run   ```

指南把人为制造启动崩溃列为验证安装的必需步骤；崩溃报告会在应用下次启动时发往 Firebase，并要求验证后删除测试代码。

查看原文
references/android_setup.md:110来自说明文档打开原文件
### Required: Force a Test CrashTo verify that Crashlytics is correctly installed, you need to force a testcrash in the app.1. Add code to your main activity (e.g., in `onCreate`) to trigger a crash a few   seconds after app startup:   ```kotlin   import android.os.Handler   import android.os.Looper   // ... in your Activity's onCreate method or similar startup logic   Handler(Looper.getMainLooper()).postDelayed({       throw RuntimeException("Test Crash") // Force a crash after 3 seconds   }, 3000)   ```
references/android_setup.md:131来自说明文档打开原文件
1. Restart the app. The Crashlytics SDK will send the crash report to Firebase   on the next app launch.1. After a few minutes, the crash should be available in the Firebase console.   Go to **DevOps & Engagement** > **Crashlytics** to view your dashboard and   crash reports.- If the Firebase MCP server is installed, use the `get_report` tool to check  that a crash was received.- As a fallback, visit the Crashlytics dashboard in the Firebase console to see  the new crash report.5. After verifying that Firebase has received the crash report - either using   the `get_report` tool or manually viewing it in the Firebase console - remove   the code from step 1 that triggers the crash. This prevents the application   from always crashing on start up after a delay.
从这里开始 · 工作说明SKILL.md
firebase-crashlytics
连线表示工作说明包含的模块，不是实际运行顺序。点击模块可查看原文。

文件引用关系图

2 处引用
哪些文件发起引用引用了什么
连线表示真实的文件引用，不是运行顺序。点击节点可高亮相关连线，并查看具体文件和原文位置。虚线表示还有文件需要定位。
文件与检查记录3 个文件

检查范围与遗漏

逐文件查看涉及的内容

下方列出本次涉及的原文范围；纳入检查不代表已查清所有问题。

  • SKILL.md已纳入全文
  • references/android_setup.md已纳入全文
  • references/ios_setup.md已纳入全文

这份报告只针对上方版本。我们看了拿到的代码和说明文件，没有实际运行 Skill，也没有检查它另外安装的软件包。因此，这不是“保证安全”的承诺；换了版本或使用环境，结果也可能不同。

  • SKILL.md工作说明
  • references/android_setup.md配套文件
  • references/ios_setup.md配套文件

代码和说明中提到的操作

安装其他软件包
SKILL.md:4来自说明文档打开原文件
description: Comprehensive guide for Firebase Crashlytics, including provisioning and SDK usage. Use this skill when the user needs help setting up Crashlytics, adding crash reporting, or using the Crashlytics SDK in their application.compatibility: This skill is best used with the Firebase CLI, but does not require it. Firebase CLI can be accessed through `npx -y firebase-tools@latest`.metadata:
references/android_setup.md:16来自说明文档打开原文件
- **Firebase Project**: Created via  `npx -y firebase-tools@latest projects:create` (see `firebase-basics`).- **Firebase App**: Created via
references/android_setup.md:18来自说明文档打开原文件
- **Firebase App**: Created via  `npx -y firebase-tools@latest apps:create <IOS|ANDROID|WEB> <package-name-or-bundle-id>`
连接外部网站
SKILL.md:42来自说明文档打开原文件
- **Android**:  [Customize Crash Reports for Android](https://firebase.google.com/docs/crashlytics/android/customize-crash-reports.md)- **iOS**:
SKILL.md:44来自说明文档打开原文件
- **iOS**:  [Customize Crash Reports for Apple Platforms](https://firebase.google.com/docs/crashlytics/ios/customize-crash-reports.md)
references/android_setup.md:32来自说明文档打开原文件
Fetch the[latest version from the Google Maven repository](https://maven.google.com/web/index.html?q=firebase-crashlytics-gradle#com.google.firebase:firebase-crashlytics-gradle)before adding this.
运行命令
references/ios_setup.md:45来自说明文档打开原文件
   target's "Build Phases" with the following content:   ```bash   ${BUILD_DIR%/Build/*}/SourcePackages/checkouts/firebase-ios-sdk/Crashlytics/run
读取了多少行
314
文件校验值（用于核对版本）
4ade61a23bce77087fd9a164cbbe7d570af0dc932d6871db74c5a64e947dba04