tech-firebase

Inspect Firebase Realtime Database, Firestore, Cloud Storage, and GCP security configurations.

Updated Jul 30, 2026

Search Tags:#security #audit #gcp #cloud #firebase #pentest

Ready to run

npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill tech-firebase

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: tech-firebase
Source: https://github.com/salmanabdurrahman/pi-pentest-agent/tree/main/skills/tech-firebase
Command: npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill tech-firebase

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill addresses the critical need for automated, read-only security assessments of Firebase and Google Cloud Platform projects, identifying misconfigurations that could lead to data exposure or unauthorized access.

Core Features & Use Cases

Security Rules Evaluation: Analyzes Realtime Database and Firestore rules to detect public read/write vulnerabilities.
Configuration Hardening: Audits API key restrictions, IAM permission boundaries, and authentication settings to ensure least-privilege access.
Use Case: A security engineer can use this tool to verify that a production Firebase project is not exposing sensitive user data via insecure database rules or overly permissive Cloud Storage buckets.

Quick Start

Use the tech-firebase skill to perform a comprehensive security review of the Firebase project identified by the provided project ID and configuration object.

Frequently Asked Questions about tech-firebase

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit Firebase security rules for public read or write vulnerabilities?▼

Yes, you can audit Cloud Storage buckets by inspecting associated GCP resources and IAM policies. The Skill validates permission boundaries and identifies potential data exposure vectors through read-only inspection of your Firebase-backed application infrastructure.

How do I check if my GCP API key restrictions follow least-privilege access?▼

Checking API key restrictions requires auditing their scopes and authentication settings to ensure least-privilege access. This Skill analyzes API key scopes and IAM permission boundaries to verify that your configuration hardening meets security standards.

Can I use this for bug bounty reconnaissance on Firebase projects?▼

The Skill performs read-only inspection of Firebase and GCP resources, meaning it does not modify your infrastructure. It is designed for automated security assessments to verify production projects are not exposing sensitive user data.

What do I need to provide to start a Firebase security posture audit?▼

To start a Firebase security posture audit, you need to provide the Firebase project ID and configuration object. This allows the Skill to perform a comprehensive security review of your Realtime Database, Firestore, and Cloud Storage resources.