firestore-security-rules-auditor
Automated security auditor for Firestore rules using red-team methodology and structured scoring.
What it does
- emailverified is also checked (request.auth.token.emailverified == true).
- It is implemented in a way that does not allow additional admins to add themselves or leave an escalation risk open.
- 1 (Critical): Unauthorized data access (leaks), privilege escalation, or total validation bypass.
- 2 (Major): Broken business logic, self-assigned roles, bypass of controls.
- 3 (Moderate): PII exposure (e.g., public emails), Inconsistent validation (create vs update) on critical fields
- 5 (Secure): Comprehensive validation, strict ownership, and role-based access via secure ACLs.
Requirements & configuration
- emailverified is also checked (request.auth.token.emailverified == true).
Derived from the skill's own SKILL.md documentation · extracted 2026-07-23
Automated security auditor for Firestore rules using red-team methodology and structured scoring.
Source
Repository: https://github.com/firebase/agent-skills
firestore-security-rules-auditor FAQ
What does the firestore-security-rules-auditor skill do?
A skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust. emailverified is also checked (request.auth.token.emailverified == true). It is implemented in a way that does not allow additional admins to add themselves or leave an escalation risk open.
What does firestore-security-rules-auditor require?
emailverified is also checked (request.auth.token.emailverified == true).
How do I install firestore-security-rules-auditor?
Run: npx -y skills add https://github.com/firebase/agent-skills --skill firestore-security-rules-auditor --agent claude-code — the source lives at github.com/firebase/agent-skills.
Maintain firestore-security-rules-auditor?
Let people know it's listed here — add the badge (live metrics, light/dark aware) or a plain link to your README or docs.
[](https://getagentictools.com/skills/firebase-agent-skills-firestore-security-rules-auditor?ref=badge) npx agentictools info skills/firebase-agent-skills-firestore-security-rules-auditor The second line is the CLI lookup for this page — handy in READMEs and docs.
Related skills
clerk Intelligent router that directs authentication tasks to specialized Clerk skills based on your framework and use case.
best-practices Apply modern web development best practices for security, compatibility, and code quality. Use when asked to "apply best practice…
security-requirement-extraction Transform threat analysis into actionable security requirements.
solidity-security Comprehensive smart contract security patterns, vulnerability prevention, and secure Solidity development practices.
insforge Client-side SDK for database queries, authentication, file uploads, AI features, real-time messaging, and edge function invocatio…
better-auth-security-best-practices better auth security best practices