Scans Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud functions.
SkillScore82Maintained
On-demandOn-demand: invoked explicitly — never occupies your agent's context until called.
◆Security & AppSec pack
Last verified 8/7/2026
What it changes
Passed 18 of 22 test cases with the skill, and 13 of 22 without it.
Without skill59%
With skill82%
Checks it passed that the model alone missed
Classifies enabled anonymous authentication as HIGH severity
Classifies email enumeration vulnerability as MEDIUM severity
Sends GET request to https://firebasestorage.googleapis.com/v0/b/logistics-prod.appspot.com/o
and 2 more in the full report
5 fixed13 passed either way4 still failing0 broke
Pass-rate lift
+23 pp
Tokens
+70%
Agent turns
0%
Response time
-35%
Model gemini-3.6-flashMeasured 8/7/2026v118 of 22 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 5 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 5
Prompt
What HTTP header and URL path combination is required to test unauthenticated Remote Config fetch for project 'mobile-cfg-123' using an API key?
What was checked, without and with the skill
Checked
Without skill
With skill
Includes x-goog-api-key header in GET request to https://firebaseremoteconfig.googleapis.com/v1/projects/mobile-cfg-123/remoteConfig
Missed
Passed
case-15 · gemini-3.6-flash · 8/7/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md189 lines3 files
Firebase APK Security Scanner
You are a Firebase security analyst. When this skill is invoked, scan the provided APK(s) for Firebase misconfigurations and report findings.
When to Use
Auditing Android applications for Firebase security misconfigurations
Testing Firebase endpoints extracted from APKs (Realtime Database, Firestore, Storage)
Enumerating Cloud Functions and testing for unauthenticated access
Mobile app security assessments involving Firebase backends
Authorized penetration testing of Firebase-backed applications
When NOT to Use
Scanning apps you do not have explicit authorization to test
Testing production Firebase projects without written permission
When you only need to extract Firebase config without testing (use manual grep/strings instead)
For non-Android targets (iOS, web apps) - this skill is APK-specific
When the target app does not use Firebase
Rationalizations to Reject
When auditing, reject these common rationalizations that lead to missed or downplayed findings:
"The database is read-only so it's fine" - Data exposure is still a critical finding; PII, API keys, and business data may be leaked
"It's just anonymous auth, not real accounts" - Anonymous tokens bypass auth != null rules and can access "authenticated-only" resources
"The API key is public anyway" - A public API key does not justify open database rules or disabled auth restrictions
"There's no sensitive data in there" - You cannot know what data will be stored in the future; insecure rules are vulnerabilities regardless of current content
"It's an internal app" - APKs can be extracted from any device; "internal" apps are not protected from reverse engineering
"We'll fix it before launch" - Document the finding; pre-launch vulnerabilities frequently ship to production
Reference Documentation
For detailed vulnerability patterns and exploitation techniques, consult:
Vulnerability Patterns Reference
How to Use This Skill
The user will provide an APK file or directory: $ARGUMENTS
Graph-informed mutation testing triage. Parses codebases with Trailmark, runs mutation testing and necessist, then uses survived mutants, unnecessary test statements, and call graph data to identify false positives, missing test coverage, and fuzzing targets. Use when triaging survived mutants, analyzing mutation testing results, identifying test gaps, finding fuzzing targets from weak tests, running mutation frameworks (including circomvent and cairo-mutants), or using necessist.