firebase-basics
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSPERSISTENCECOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill makes extensive use of
npx -y firebase-tools@latestto execute the Firebase CLI directly from the npm registry, ensuring the latest version is used. It also provides instructions for installing theflutterfire_cliviadart pub global activateand managing agent skills through theskillsCLI. These operations are standard for installing and running development tooling in the supported environments. - [EXTERNAL_DOWNLOADS]: Several reference files guide the installation of required SDKs and version managers from official and well-known sources. This includes downloading Node.js from
nodejs.org, the Flutter SDK fromdocs.flutter.dev, and Node Version Manager (nvm) from official GitHub repositories (nvm-sh/nvmandcoreybutler/nvm-windows). These resources are fetched from trusted domains and are necessary for the skill's stated purpose. - [PERSISTENCE]: The Flutter setup guide (
references/flutter_setup.md) contains instructions to modify the user's shell profile (~/.zshrc) to add the Flutter SDKbindirectory to the system PATH. This is a standard persistence mechanism used for environment configuration and is not indicative of malicious intent in this context. - [COMMAND_EXECUTION]: The skill instructs the agent to perform routine filesystem and environment operations, such as creating directories (
mkdir), navigating projects (cd), and verifying software versions. These commands are appropriately scoped to initializing and configuring Firebase projects.
Audit Metadata