Setup & Installation
npx skills add https://github.com/firebase/agent-skills --skill firebase-security-rules-auditor
https://github.com/firebase/agent-skills/tree/main/skills/firebase-security-rules-auditor
View on GitHubWhat This Skill Does
Audits Firestore security rules by scoring them on a 1-5 scale and flagging specific vulnerabilities. It checks for update bypasses, privilege escalation, missing type validation, resource exhaustion risks, and gaps between identity-level and field-level access control.
Firestore rules are easy to get wrong in subtle ways, like allowing valid creates but unsafe updates, and a structured red-team checklist catches issues that manual review tends to miss.
When to use it
- Reviewing Firestore rules after adding a new collection or changing data structure
- Checking whether update rules let users modify fields they shouldn't touch
- Spotting missing type checks or string length limits that could lead to storage abuse
- Validating that admin bootstrapping logic doesn't open privilege escalation paths
- Auditing read access rules to confirm PII fields aren't exposed to other users