skills.rest
salmanabdurrahman
salmanabdurrahmanCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

tech-firebase

Inspect Firebase Realtime Database, Firestore, Cloud Storage, and GCP security configurations.

Updated Jul 30, 2026
Search Tags:#security#audit#gcp#cloud#firebase#pentest
One-click install
npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill tech-firebase
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: tech-firebase
Source: https://github.com/salmanabdurrahman/pi-pentest-agent/tree/main/skills/tech-firebase
Command: npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill tech-firebase

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill addresses the critical need for automated, read-only security assessments of Firebase and Google Cloud Platform projects, identifying misconfigurations that could lead to data exposure or unauthorized access.

Core Features & Use Cases

  • Security Rules Evaluation: Analyzes Realtime Database and Firestore rules to detect public read/write vulnerabilities.
  • Configuration Hardening: Audits API key restrictions, IAM permission boundaries, and authentication settings to ensure least-privilege access.
  • Use Case: A security engineer can use this tool to verify that a production Firebase project is not exposing sensitive user data via insecure database rules or overly permissive Cloud Storage buckets.

Quick Start

Use the tech-firebase skill to perform a comprehensive security review of the Firebase project identified by the provided project ID and configuration object.

Frequently Asked Questions about tech-firebase

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit Firebase security rules for public read or write vulnerabilities?▼

Yes, you can audit Cloud Storage buckets by inspecting associated GCP resources and IAM policies. The Skill validates permission boundaries and identifies potential data exposure vectors through read-only inspection of your Firebase-backed application infrastructure.

How do I check if my GCP API key restrictions follow least-privilege access?▼

Checking API key restrictions requires auditing their scopes and authentication settings to ensure least-privilege access. This Skill analyzes API key scopes and IAM permission boundaries to verify that your configuration hardening meets security standards.

Can I use this for bug bounty reconnaissance on Firebase projects?▼

The Skill performs read-only inspection of Firebase and GCP resources, meaning it does not modify your infrastructure. It is designed for automated security assessments to verify production projects are not exposing sensitive user data.

What do I need to provide to start a Firebase security posture audit?▼

To start a Firebase security posture audit, you need to provide the Firebase project ID and configuration object. This allows the Skill to perform a comprehensive security review of your Realtime Database, Firestore, and Cloud Storage resources.

Related Skills

Explore More Software Engineering Skills→
YukiIto1999YukiIto1999

performing-gcp-security-assessment-with-forseti

Audit GCP IAM bindings, firewall rules, storage permissions, and CIS benchmarks.

Community
Advanced
AgentientAgentient
2

gcp-hardening

Enforce IAM least privilege, VPC security, and Secret Manager usage on Google Cloud Platform.

Official
Basic
kubonykubony
10

gcp-logs

Query and filter Cloud Logging data across GCP projects using gcloud logging read.

Community
Intermediate
manuelbrandner85manuelbrandner85

firebase-apk-scanner

Scan Android APK files for Firebase security misconfigurations.

Community
Advanced