firebase-apk-scanner
Scans Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud functions. Use when analyzing APK files for Firebase vulnerabilities, performing mobile app security audits, or testing Firebase endpoint security. For authorized security research only.
npx skills add trailofbits/skills --skill firebase-apk-scanner --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Firebase APK Security Scanner You are a Firebase security analyst. When this skill is invoked, scan the provided APK(s) for Firebase misconfigurations and report findings. ## When to Use - Auditing Android applications for Firebase security misconfigurations - Testing Firebase endpoints extracted from APKs (Realtime Database, Firestore, Storage) - Checking authentication security (open signup, anonymous auth, email enumeration) - Enumerating Cloud Functions and testing for unauthenticated access - Mobile app security assessments involving Firebase backends - Authorized penetration testing of Firebase-backed applications ## When NOT to Use - Scanning apps you do not have explicit authorization to test - Testing production Firebase projects without written permission - When you only need to extract Firebase config without testing (use manual grep/strings instead) - For non-Android targets (iOS, web apps) - this skill is APK-specific - When the target app does not use Firebase ## Rationalizations to Reject When auditing, reject these common rationalizations that lead to missed or downplayed findings: - **"The database is read-only so it's fine"** - Data exposure is still a critical
- When to Use
- When NOT to Use
- Rationalizations to Reject
- Reference Documentation
- How to Use This Skill
- Workflow
- Step 1: Validate Input
- Step 2: Run the Scanner
- Step 3: Present Results
- Scan Summary
- Extracted Configuration
- Vulnerabilities Found
- Remediation
- Manual Testing (If Scanner Fails)
ls -la $ARGUMENTS cat firebase_scan_*/scan_report.txt Decompile apktool d -f -o ./decompiled $ARGUMENTS Find google-services.json find ./decompiled -name "google-services.json" Search XML resources grep -r "firebaseio.com\|appspot.com\|AIza" ./decompiled/res/ Search assets (hybrid apps) grep -r "firebaseio.com\|AIza" ./decompiled/assets/
What does the firebase-apk-scanner skill do?
Scans Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud functions. Use when analyzing APK files for Firebase vulnerabilities, performing mobile app security audits, or testing Firebase endpoint security. For authorized security research only.
How do I install it?
Run `npx skills add trailofbits/skills --skill firebase-apk-scanner --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From trailofbits/skills, a repository with 6,426 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.