Firestore Security Rules Auditor

This takes a red team approach to auditing Firestore security rules, specifically looking for the kinds of bypasses that actually happen in production. It checks for the classic create/update split where users bootstrap valid documents then mutate them into privileged states, sniffs out rules that trust client-provided role fields, and flags missing size limits that let attackers stuff documents until you hit quota. The field-level versus identity-level distinction is smart: it catches rules that restrict which fields change but forget to check who's changing them. If you're shipping anything with user-generated Firestore data, running this before launch will save you from the "wait, users can just set isAdmin to true?" postmortem.

Install to Claude Code

npx -y skills add firebase/agent-skills --skill firestore-security-rules-auditor --agent claude-code