Claude MarketplacesSubmit
firebase avatar

Firestore Security Rules Auditor

firebase/agent-skillsOfficial

This takes a red team approach to auditing Firestore security rules, specifically looking for the kinds of bypasses that actually happen in production. It checks for the classic create/update split where users bootstrap valid documents then mutate them into privileged states, sniffs out rules that trust client-provided role fields, and flags missing size limits that let attackers stuff documents until you hit quota. The field-level versus identity-level distinction is smart: it catches rules that restrict which fields change but forget to check who's changing them. If you're shipping anything with user-generated Firestore data, running this before launch will save you from the "wait, users can just set isAdmin to true?" postmortem.

skills.sh installs
20.4K
GitHub stars
508
last updated
Aug 21, 2026
View on GitHub

Install

$ npx -y skills add firebase/agent-skills --skill firestore-security-rules-auditor --agent claude-code

Installs into .claude/skills of the current project.

Files

This takes a red team approach to auditing Firestore security rules, specifically looking for the kinds of bypasses that actually happen in production. It checks for the classic create/update split where users bootstrap valid documents then mutate them into privileged states, sniffs out rules that trust client-provided role fields, and flags missing size limits that let attackers stuff documents until you hit quota. The field-level versus identity-level distinction is smart: it catches rules that restrict which fields change but forget to check who's changing them. If you're shipping anything with user-generated Firestore data, running this before launch will save you from the "wait, users can just set isAdmin to true?" postmortem.

Browse the repository on GitHub

Sponsors

Promote your product hereReach 125k+ visitors monthlyPromote your product hereReach 125k+ visitors monthlyAgent CaffeineSponsoredClose your lid, come back to finished workSnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthlyWaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthlyknobsSponsoredSee your site on any phone, any day, in any language

Details

Repository
github.com/firebase/agent-skills
Categories
Backend & APIs, Security, AI & Agent Building, Databases
First seen
Apr 16, 2026

More from firebase/agent-skills

All 23

Recommended

More Backend & APIs
1figma avatarfigma-generate-designfigma/mcp-server-guideUse this skill alongside figma-use when the task involves translating an application page, view, or multi-section layout into Figma. Triggers: 'write to Figma',6.4Kskills.sh installs
2figma avatarimplement-designfigma/mcp-server-guideTranslates Figma designs into production-ready code with 1:1 visual fidelity. Use when implementing UI from Figma files, when user mentions "implement design", 5.9Kskills.sh installs
3figma avatarfigma-implement-designfigma/mcp-server-guideTranslates Figma designs into production-ready application code with 1:1 visual fidelity. Use when implementing UI code from Figma files, when user mentions "im4Kskills.sh installs
4figma avatarfigma-create-new-filefigma/mcp-server-guide**MANDATORY prerequisite** — you MUST invoke this skill BEFORE every `create_new_file` tool call. NEVER call `create_new_file` directly without loading this ski3.7Kskills.sh installs
5figma avatarfigma-code-connectfigma/mcp-server-guideCreates and maintains Figma Code Connect template files that map Figma components to code snippets. Use when the user mentions Code Connect, Figma component map3.6Kskills.sh installs
6figma avatarfigma-use-figjamfigma/mcp-server-guideThis skill helps agents use Figma's use_figma MCP tool in the FigJam context. Can be used alongside figma-use which has foundational context for using the use_f2.2Kskills.sh installs