firebase-apk-scanner
Fail
Audited by Gen Agent Trust Hub on Feb 28, 2026
Risk Level: HIGHCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill's workflow and manual testing sections directly interpolate the
$ARGUMENTSvariable into shell commands without protective shell quoting. This occurs in multiple instances: ls -la $ARGUMENTSin the validation step.{baseDir}/scanner.sh $ARGUMENTSwhen executing the main scanner script.apktool d -f -o ./decompiled $ARGUMENTSin the manual testing instructions.- An attacker could exploit this by providing a string containing shell metacharacters (e.g.,
;,&,|) to execute unauthorized commands on the underlying system. - [EXTERNAL_DOWNLOADS]: The skill utilizes
curlto interact with remote Firebase and Google API endpoints for security testing purposes. It targets well-known services includingidentitytoolkit.googleapis.com,firebaseio.com,firestore.googleapis.com, andfirebasestorage.googleapis.com. These network operations are consistent with the skill's intended functionality of auditing Firebase backends.
Recommendations
- AI detected serious security threats
Audit Metadata