Skill · em Proteger

firebase-security-rules-auditor

Audits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege escalation, role bypasses, create vs update inconsistencies, resource exhaustion, type safety, size limits, and hasOnly ownership checks. Use when auditing/reviewing rules, running red-team rule assessments, or…

Procedência

Antes de instalar

1 arquivo · 3,8 KB · só texto, nenhum script

Instalar na sua CLI

O comando baixa a versão fixada (commit c2630ec) direto da origem, para a pasta que a CLI lê. Precisa de curl (macOS e Linux); no Windows não há comando, porque o Rook Labs é para macOS.

Claude Code

Neste projeto: instala em .claude/skills/firebase-security-rules-auditor/.

d=".claude/skills/firebase-security-rules-auditor"
u="https://raw.githubusercontent.com/firebase/agent-skills/c2630ec5c7a3f5bb31ddf89f8baa9eb883f8d715/skills/firebase-security-rules-auditor"
curl -fsSL --create-dirs \
  -o "$d/SKILL.md" "$u/SKILL.md" \
  -o "$d/LICENSE" "https://raw.githubusercontent.com/firebase/agent-skills/c2630ec5c7a3f5bb31ddf89f8baa9eb883f8d715/LICENSE"

Global: instala em ~/.claude/skills/firebase-security-rules-auditor/.

d="$HOME/.claude/skills/firebase-security-rules-auditor"
u="https://raw.githubusercontent.com/firebase/agent-skills/c2630ec5c7a3f5bb31ddf89f8baa9eb883f8d715/skills/firebase-security-rules-auditor"
curl -fsSL --create-dirs \
  -o "$d/SKILL.md" "$u/SKILL.md" \
  -o "$d/LICENSE" "https://raw.githubusercontent.com/firebase/agent-skills/c2630ec5c7a3f5bb31ddf89f8baa9eb883f8d715/LICENSE"

Codex

Neste projeto: instala em .agents/skills/firebase-security-rules-auditor/.

d=".agents/skills/firebase-security-rules-auditor"
u="https://raw.githubusercontent.com/firebase/agent-skills/c2630ec5c7a3f5bb31ddf89f8baa9eb883f8d715/skills/firebase-security-rules-auditor"
curl -fsSL --create-dirs \
  -o "$d/SKILL.md" "$u/SKILL.md" \
  -o "$d/LICENSE" "https://raw.githubusercontent.com/firebase/agent-skills/c2630ec5c7a3f5bb31ddf89f8baa9eb883f8d715/LICENSE"

Global: instala em ~/.agents/skills/firebase-security-rules-auditor/.

d="$HOME/.agents/skills/firebase-security-rules-auditor"
u="https://raw.githubusercontent.com/firebase/agent-skills/c2630ec5c7a3f5bb31ddf89f8baa9eb883f8d715/skills/firebase-security-rules-auditor"
curl -fsSL --create-dirs \
  -o "$d/SKILL.md" "$u/SKILL.md" \
  -o "$d/LICENSE" "https://raw.githubusercontent.com/firebase/agent-skills/c2630ec5c7a3f5bb31ddf89f8baa9eb883f8d715/LICENSE"

Antigravity

Neste projeto: instala em .agents/skills/firebase-security-rules-auditor/.

d=".agents/skills/firebase-security-rules-auditor"
u="https://raw.githubusercontent.com/firebase/agent-skills/c2630ec5c7a3f5bb31ddf89f8baa9eb883f8d715/skills/firebase-security-rules-auditor"
curl -fsSL --create-dirs \
  -o "$d/SKILL.md" "$u/SKILL.md" \
  -o "$d/LICENSE" "https://raw.githubusercontent.com/firebase/agent-skills/c2630ec5c7a3f5bb31ddf89f8baa9eb883f8d715/LICENSE"

Global: instala em ~/.gemini/antigravity-cli/skills/firebase-security-rules-auditor/.

d="$HOME/.gemini/antigravity-cli/skills/firebase-security-rules-auditor"
u="https://raw.githubusercontent.com/firebase/agent-skills/c2630ec5c7a3f5bb31ddf89f8baa9eb883f8d715/skills/firebase-security-rules-auditor"
curl -fsSL --create-dirs \
  -o "$d/SKILL.md" "$u/SKILL.md" \
  -o "$d/LICENSE" "https://raw.githubusercontent.com/firebase/agent-skills/c2630ec5c7a3f5bb31ddf89f8baa9eb883f8d715/LICENSE"

Peça ao Rook

Já usa o Rook Labs? Cole no chat do Rook: instale a skill https://rooklabs.sh/marketplace/firebase.agent-skills.firebase-security-rules-auditor

Prévia do SKILL.md

---
name: firebase-security-rules-auditor
description: >-
  Audits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege escalation, role bypasses, create vs update inconsistencies, resource exhaustion, type safety, size limits, and hasOnly ownership checks. Use when auditing/reviewing rules, running red-team rule assessments, or scoring against au…
metadata:
  category: CloudSecurity
---

# Overview

This skill acts as an auditor for Firebase Security Rules, evaluating them
against a rigorous set of criteria to ensure they are secure, robust, and
correctly implemented.

# Scoring Criteria

## Assessment: Security Validator (Red Team Edition)

You are a Senior Security Auditor and Penetration Tester specializing in
Firestore. Your goal is to find "the hole in the wall." Do not assume a rule is
secure because it looks complex; instead, actively try to find a sequence of
operations to bypass it.

### Mandatory Audit Checklist:

1. **The Update Bypass:** Compare 'create' and 'update' rules. Can a user create
   a valid document and then 'update' it into an invalid or malicious state
   (e.g., changing their role, bypassing size limits, or corrupting data types)?
1. **Authority Source:** Does the security rely on user-provided data
   (request.resource.data) for sensitive fields like 'role', 'isAdmin', or
   'ownerId'? Carefully consider the source for that authority.
1. **Business Logic vs. Rules:** Does the rule set actually support the app's
   purpose? (e.g., In a collaboration app, can collaborators actually read the
   data? If not, the rules are "broken" or will force insecure workarounds).
1. **Storage Abuse:** Are there string length or array size limits? If not,
   label it as a "Resource Exhaustion/DoS" risk.
1. **Type Safety:** Are fields checked with 'is string', 'is int', or 'is
   timestamp'?
1. **Field-Level vs. Identity-Level Security:** Be careful with rules that use
   `hasOnly()` or `diff()`. While these restrict *which* fields can be
…

Ver todo o marketplace