Search skills/

Firebase Agent Skills Claude skills

Google's 13 official Firebase skills: CLI and project setup, Auth, Firestore, Hosting, App Hosting, Data Connect, AI Logic and security rules.

firebase/agent-skills 13 skills Cloud & DevOpsBackend & databases
Our verdict Recommended

Official, Apache-2.0 and broad across Firebase products; it uses unpinned npx -y firebase-tools@latest and your Firebase login, so run it against the right project.

3/5 Depth expertise shipped Note Security Review before installing 0d Maintenance Updated today 1.8M Adoption installs OK License Apache-2.0, commercial OK

What Firebase Agent Skills does

This is the Firebase team's own skill pack. The firebase-basics skill is the entry point: it has the agent check for the Firebase CLI through npx -y firebase-tools@latest, log in (including a no-localhost flow for remote shells), pick or create a project and ask you which one to use if none was given. It also steers the agent to the Firebase MCP server instead of raw API calls and, through setup references for Gemini CLI, Claude Code, Cursor, GitHub Copilot and Antigravity, to the full set of Firebase skills.

The other skills cover specific products: Auth (web and Android SDK references), Firestore, Hosting, App Hosting, Data Connect, Remote Config, Crashlytics, Firebase AI Logic, Xcode project setup, converting a Firebase Extension into a Cloud Functions codebase, and two security-rules skills (a rules auditor and a 28 KB firestore-rules-creation skill). SKILL.md files average about 7 KB, with the largest reference sets in firebase-basics (19 files), Data Connect (16) and Firestore (14). There are no scripts or evals. Installation options in the README include the skills CLI, a Gemini CLI extension, Claude and Codex plugin marketplaces, Kimi, or a manual copy.

Good for

  • Developers building on Firebase who want an agent that follows current Google guidance
  • Writing and auditing Firestore security rules
  • Setting up Firebase CLI, MCP and project context in different agent tools

Not for

  • Projects not using Firebase
  • Teams that require pinned tool versions (the skills run firebase-tools@latest through npx)

What's inside depth 3/5

13 skills averaging 7 KB with sizable reference sets (up to 19 files in one skill), but no scripts, tests or evals.

Skills
13
Reference docs
70
Scripts
0
Tests / evals
0
Templates
0
Avg SKILL.md
7 KB

Counted from the repository file tree. How we score depth.

Dependencies and costs

  • Node.js 20 or newer
  • Firebase CLI login (via npx firebase-tools) and a Firebase project
  • Optional: Firebase MCP server

Security review

Review before installing

Google's official Firebase skills: Markdown guides plus an MCP config that runs firebase-tools through npx and a Swift helper that edits Xcode projects. Commands act on your signed-in Firebase account and may deploy or set secrets when you ask. The Claude config pins the CLI version, while several skill commands use @latest.

Worth knowing

  • Runs remote code at an unpinned versionThe Kiro MCP config and many SKILL.md commands run npx -y firebase-tools@latest ...; only the Claude/Codex .mcp.json pins firebase-tools@15.32.1.kiro/mcp.json:5
  • Relies on a CLI or package we could not reviewThe plugin launches the Firebase CLI's MCP server through npx (firebase-tools), and the skills run firebase commands such as init, deploy and apphosting:secrets:set that act on your signed-in Firebase/Google account; that code is not in the repo..mcp.json:5
  • Makes network requestsAndroid setup references tell the agent to curl Maven metadata from dl.google.com to look up the latest library versions.skills/firebase-crashlytics/references/android_setup.md:29
  • Installs packages or toolsMaintainer script creates a venv and pip-installs mdformat and plugins; scripts/skill-token-counter (maintainer tool) uses GEMINI_API_KEY from the environment to call Google's token-count API.scripts/format.sh:17

What we checked

The repository (112 files) on Oct 29, 2026. Not a full review: we read 4 of 14 code files; it relies on code outside the repository: firebase-tools npm package and Firebase MCP server (run via npx at runtime); Not read in full: scripts/format.py, scripts/skill-token-counter/index.js, the Swift tool's Sources/main.swift, and the other plugin manifests.

NVIDIA SkillSpector static scan: 235 pattern hits (MCP Rug Pull 179, Rogue Agent 48, Privilege Escalation 4, Data Exfiltration 2, Dangerous Code Execution 1, Supply Chain 1). About 180 hits are unpinned npx mentions in docs; 'Session Persistence' hits are plist/Info.plist references in Xcode setup instructions; 'sudo' is a note telling the agent not to install system packages itself. Credential hits are .env.local examples and Firebase secret-handling documentation.

A review, not a certification. Skills change after we check them — read the files before installing.

License

Apache-2.0 — commercial use allowed.

Can it run unattended?

Not really. These are product-setup and reference skills for interactive work; they define no unattended loop, and they ask the agent to pause and confirm the Firebase project.

Skills in this repository

SkillInstalls
firebase-basics177K
firebase-auth-basics176K
firebase-hosting-basics172K
firebase-app-hosting-basics171K
firebase-data-connect170K
firebase-security-rules-auditor140K
firebase-ai-logic-basics137K
firebase-firestore137K
firebase-crashlytics133K
xcode-project-setup132K
firebase-remote-config-basics123K
developing-genkit-js62K
developing-genkit-dart62K

Linked skills have their own review.

Alternatives to Firebase Agent Skills

Supabase Agent Skills

supabase/agent-skills

Supabase's official skills: a general Supabase skill for Auth, RLS, CLI and MCP, and a Postgres best-practices skill with 34 rule files.

Recommended Check first Depth 3/5

Google Agent Skills

google/skills

Google's official collection of about 180 skills for Google Cloud, Gemini APIs, Analytics, Data Manager, sign-in and other Google products.

Recommended Broad access Depth 3/5

Neon Agent Skills

neondatabase/agent-skills

Neon's official skills for Lakebase Postgres and its Auth, Functions, Object Storage, AI Gateway and Realtime services, with branch-first workflows and evals.

With caveats Broad access Depth 4/5

InsForge Agent Skills

InsForge/insforge-skills

Four skills for building on the InsForge backend-as-a-service: SDK integration, CLI project management, debugging and auth-provider integrations.

With caveats Broad access Depth 3/5

FAQ

What are the Firebase agent skills?

They are 13 skills published by Firebase for coding agents. They cover CLI and project setup, Auth, Firestore, Hosting, App Hosting, Data Connect, Remote Config, Crashlytics, AI Logic, Xcode setup and Firestore security rules.

How do I install the Firebase skills?

Run npx skills add firebase/skills, or use the Gemini CLI extension, claude plugin marketplace add firebase/skills then claude plugin install firebase@firebase, or the Codex plugin commands. The README also describes a manual copy for Cursor and Copilot.

Do the Firebase skills need the Firebase MCP server?

Not strictly, but firebase-basics tells the agent to prefer the Firebase MCP server over direct API calls and to set it up through the per-agent references.

Are the Firebase skills safe?

We found no hidden code or credential access. The skills run npx -y firebase-tools@latest and rely on your Firebase login, so confirm the active project before letting an agent change anything.

Sources: GitHub repository (stars, license, file tree, last push Oct 29, 2026); install counts from skills.sh via Best Skills (CC BY 4.0). Review based on the README and SKILL.md files as published.