firebase-basics

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSPERSISTENCECOMMAND_EXECUTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill makes extensive use of npx -y firebase-tools@latest to execute the Firebase CLI directly from the npm registry, ensuring the latest version is used. It also provides instructions for installing the flutterfire_cli via dart pub global activate and managing agent skills through the skills CLI. These operations are standard for installing and running development tooling in the supported environments.
  • [EXTERNAL_DOWNLOADS]: Several reference files guide the installation of required SDKs and version managers from official and well-known sources. This includes downloading Node.js from nodejs.org, the Flutter SDK from docs.flutter.dev, and Node Version Manager (nvm) from official GitHub repositories (nvm-sh/nvm and coreybutler/nvm-windows). These resources are fetched from trusted domains and are necessary for the skill's stated purpose.
  • [PERSISTENCE]: The Flutter setup guide (references/flutter_setup.md) contains instructions to modify the user's shell profile (~/.zshrc) to add the Flutter SDK bin directory to the system PATH. This is a standard persistence mechanism used for environment configuration and is not indicative of malicious intent in this context.
  • [COMMAND_EXECUTION]: The skill instructs the agent to perform routine filesystem and environment operations, such as creating directories (mkdir), navigating projects (cd), and verifying software versions. These commands are appropriately scoped to initializing and configuring Firebase projects.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 04:56 PM
Security Audit — agent-trust-hub — firebase-basics