40Medium
The skill deceptively claims to deploy applications but only
Behavior Analysis
Mismatch detected — The skill's stated purpose is to 'enable the agent to deploy and manage' applications, but its actual behavior is to provide instructions for the user to manually run `firebase-tools` commands. The skill itself does not execute any deployment or management actions.
Claims to do
App Hosting Basics: This skill enables the agent to deploy and manage modern, full-stack web applications (Next.js, Angular, etc.) using Firebase App Hosting.
Actually does
The skill provides instructions for configuring `firebase.json` and `apphosting.yaml`, setting secrets using `npx firebase-tools apphosting:secrets`, and deploying full-stack applications to Firebase App Hosting via `npx firebase-tools deploy`. It also directs users to a Firebase console URL for billing upgrades.
Skill Info
Namefirebase/agent-skills/firebase-app-hosting-basics
Registrygithub
Version4679fc8dd31f
PURLpkg:github/firebase/agent-skills@4679fc8dd31f?skill=firebase-app-hosting-basics
Stars224
Installs455,628
Source
SHA-256290812d34b60...
SHA-14d177d9f8e5d...
MD550f1149b5472...
TLSH4d415087aabf...
Size2,357 bytes
Install
This skill has been flagged as potentially malicious. Review the findings below before installing.
GitHub
https://github.com/firebase/agent-skills/tree/main/skills/firebase-app-hosting-basics455,628 installs
Claude CodeDocs
/plugin marketplace add firebase/agent-skills/plugin install firebase-app-hosting-basics@firebase/agent-skills
Gemini CLIDocs
gemini extensions install https://github.com/firebase/agent-skills.git --consent
CursorDocs
Skills.shDocs
npx skills add https://github.com/firebase/agent-skills --skill firebase-app-hosting-basicsAssessments (1)
AI Agent Traps ↗Description Mismatchmediumdescription mismatch
The skill's stated purpose is to 'enable the agent to deploy and manage' applications, but its actual behavior is to provide instructions for the user to manually run `firebase-tools` commands. The skill itself does not execute any deployment or management actions.
85% confidence
The skill instructs the user to 'Run `npx -y firebase-tools@latest deploy`' and 'use `npx -y firebase-tools@latest apphosting:secrets` commands', indicating the user, not the agent, performs the actions.
Version History (2)
Dependencies (1)
firebase.claude-plugin/marketplace.jsonnot scanned
Badge
Markdown
[](https://mondoo.com/ai-agent-security/skills/github/firebase/agent-skills/firebase-app-hosting-basics)HTML
<a href="https://mondoo.com/ai-agent-security/skills/github/firebase/agent-skills/firebase-app-hosting-basics"><img src="https://mondoo.com/ai-agent-security/api/badge/github/firebase/agent-skills/firebase-app-hosting-basics.svg" alt="Mondoo Skill Check" /></a>Image URL
https://mondoo.com/ai-agent-security/api/badge/github/firebase/agent-skills/firebase-app-hosting-basics.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow