1. Habit
  2. Skills
  3. Firebase Security Rules Auditor skill
firebase · 137K installs

Firebase Security Rules Auditor skill
Runs by itself, rules file changed.

No rules change ships unaudited.

Install the Firebase Security Rules Auditor skill and make it a habit: follow https://gethabit.dev/skills/firebase/firebase-security-rules-auditor.md

  1. 1Copy
  2. 2Paste into Claude Code, Codex or Cursor
  3. 3It runs by itself

137K installs480 starsApache-2.0 licenceSource on GitHub ↗

Firebase Security Rules Auditor

by firebase · 137K installs

The skill

Firebase security rules auditor is a skill that red-teams Firestore and Cloud Storage rules for bypasses, privilege escalation, missing limits and type checks, and returns a 1 to 5 score in JSON.

Only when you ask.

The habit

No rules change ships unaudited.

↻ Runs by itselfrules file changed

How the habit works.
You don't have to.

Three questionsWhen does it start? How does it check its work? What does it remember?

01

It starts by itself

rules file changed. Runs in GitHub Actions.

  • ↻ rules file changed
  • pull_request that changes security rules

02

It checks its work

score 4 or higher. If a check fails, it tells you.

  • ✓the audit is valid JSON with score, summary and findings
  • ✓every finding names a checklist item and a severity
  • ✓no finding has severity critical or major

03

It remembers

scores and open findings. The next run reads it first: open findings from the last audit.

loops/firebase-rules-audit-loop/run-log.md

One run, step by step.
Then it stops.

Stop ruleStops after one audit per pull request, with no retries.

  1. 01

    Read the rules

    Read the changed Firestore or Cloud Storage rules and the app's purpose.

  2. 02

    Test update bypass

    Compare create and update rules for ways to move a valid document into a bad state.

  3. 03

    Check authority

    Flag sensitive fields like role or ownerId that trust request.resource.data.

  4. 04

    Check limits and types

    Check size limits, type checks, and that hasOnly or diff rules also check ownership.

  5. 05

    Score

    Score from 1 to 5 and return the JSON assessment with findings and fixes.

What it may do.
Nothing more.

Safe by defaultIt writes only in its own folder and asks you before anything goes out.

Is it for you?
Use it when it fits.

Quick checkRead both lists. If the left one sounds like you, the Firebase Security Rules Auditor skill helps.

Use it when

  • ✓ You review Firestore or Storage rules
  • ✓ You want a red-team pass before deploy
  • ✓ You want a score for a rules change

Skip it when

  • – You need to deploy or log in to the CLI
  • – You work on Auth setup or queries

Questions

Firebase Security Rules Auditor skill, answered.

Does it fix the rules?

No. It returns findings with a recommended fix for each.

Is a hardcoded admin email a fail?

Not if email_verified is checked and no one can add themselves as admin.

What does score 4 mean?

Minor issues only, such as missing size limits or minor type checks.

How do I install the Firebase Security Rules Auditor skill?

Copy the prompt at the top into your agent. It installs the skill from firebase/agent-skills and sets up the habit. Or run npx skills add firebase/agent-skills --skill firebase-security-rules-auditor.

Is the Firebase Security Rules Auditor skill free?

Yes. It is published under Apache-2.0. Habit is free too.

Firebase Security Rules Auditor. Now as a habit.

Install the Firebase Security Rules Auditor skill and make it a habit: follow https://gethabit.dev/skills/firebase/firebase-security-rules-auditor.md

  • Free
  • No account
  • Undo in one line

All firebase skills →More code skills →

Works in

  • Claude Code
  • Codex
  • Cursor
  • ChatGPT
  • Claude app

Made by firebase, published under Apache-2.0. Habit links to the original and never changes it. Is this your skill?

Copying didn't work here. Select the line and copy it by hand.