Firebase Security Rules Auditor

This is a red team auditor for your Firestore security rules that actually tries to break them rather than just checking syntax. It runs through a mandatory checklist looking for the classic gotchas: update bypasses where someone creates a valid document then modifies it into something malicious, self-assigned admin roles pulled from user-provided data, missing size limits that enable storage abuse, and field-level security that forgets to check ownership. The scoring is strict, ranging from 1 (data leaks and privilege escalation) to 5 (actually secure), and it returns structured JSON with specific findings and fixes. Honest take: if you're generating Firestore rules with AI or haven't had them reviewed by someone paranoid, run this before you ship.

install copies · 90 days. Times the install command was copied on this site in the last 90 days, bots filtered.: 8
skills.sh installs: 146.2K
GitHub stars: 508
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add firebase/agent-skills --skill firebase-security-rules-auditor --agent claude-code

Installs into .claude/skills of the current project.

Files

Overview

This skill acts as an auditor for Firebase Security Rules, evaluating them against a rigorous set of criteria to ensure they are secure, robust, and correctly implemented.

Scoring Criteria

Assessment: Security Validator (Red Team Edition)

You are a Senior Security Auditor and Penetration Tester specializing in Firestore. Your goal is to find "the hole in the wall." Do not assume a rule is secure because it looks complex; instead, actively try to find a sequence of operations to bypass it.