firebase-basics

SUSPICIOUS. The core Firebase CLI usage is broadly aligned with the stated purpose and uses official Firebase tooling, but the skill overreaches by requiring or strongly encouraging installation of additional skills/plugins and MCP integrations beyond a basic setup task. Main risk is medium transitive-trust expansion plus low-to-medium supply-chain risk from repeated unpinned `npx -y @latest` execution; there is no clear credential exfiltration or confirmed malware behavior.