The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill references and uses the official standalone installation script via curl -sL https://firebase.tools | bash in SKILL.md and scripts/install.sh. This targets a well-known service domain managed by Google.\n- [EXTERNAL_DOWNLOADS]: The skill installs the firebase-tools package from the official npm registry. It also provides scripts to download configuration and binaries from Google's Firebase servers.\n- [COMMAND_EXECUTION]: The helper scripts scripts/deploy.sh and scripts/emulators.sh use the eval command to execute Firebase CLI operations based on provided flags and project configuration. This is used for legitimate command assembly within the local environment.\n- [PROMPT_INJECTION]: The skill demonstrates an indirect injection surface as it ingests untrusted project data (e.g., firebase.json, users.json, and data.json in SKILL.md and scripts/deploy.sh). There are no boundary markers or explicit sanitization steps for these files. The skill possesses extensive capabilities, including subprocess execution and network operations through the Firebase CLI.

firebase-cli