agentsclimarketplace

Security privacy

Skill GDvega/super-android-kotlin-firebase-skill/skills/security-privacy

A modular Agent Skills repository for Android, Kotlin, Jetpack Compose and Firebase development.

Install
npx -y skills add GDvega/super-android-kotlin-firebase-skill --skill security-privacy

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Use for Android and Firebase security, secrets, API keys, Firebase Security Rules, local encryption, biometrics, least privilege, privacy-first data handling and sensitive data reviews.

SKILL.md

2.7 KB, 557 tokens by cl100k_base, as published. Nobody here has run it

Purpose

Reduce real security and privacy risks in Android/Firebase apps.

When to use

  • Auditing sensitive data handling.
  • Reviewing Firebase rules.
  • Checking secrets, logs or permissions.
  • Adding biometric or local encryption flows.

Inputs to inspect

  • Data classification and threat model.
  • Rules files and storage paths.
  • Logs, analytics and Crashlytics usage.
  • Permissions and local storage.

Required workflow

  1. Classify data and trust boundaries.
  2. Search for secrets and sensitive logs.
  3. Review Firebase rules and Android permissions.
  4. Propose least-privilege fixes.
  5. Add tests or manual verification steps.

Rules

  • Never exfiltrate or print secrets.
  • No open production rules.
  • Do not rely on client-only authorization.
  • Do not log PII, tokens or sensitive health/financial data.
  • Use encryption only with a clear threat model.

Related existing skills

Local skills to invoke

  • firebase-core
  • firestore
  • firebase-auth
  • code-review-refactor
  • testing

External companion skills to use when installed

Do not assume these companion skills are installed. Prefer the local skills above first, then consult Companion Skills for install and verification commands.

  • firebase/agent-skills — use for deeper Firebase product, Firestore, Security Rules or emulator workflow guidance when installed.

Files commonly touched

  • firestore.rules
  • database.rules.json
  • storage.rules
  • AndroidManifest.xml
  • logging/analytics code
  • local storage code

Commands to validate

git grep -n "apiKey\|secret\|password\|token"
firebase emulators:exec "npm test"
./gradlew lint
./gradlew test

Common mistakes to avoid

  • Putting private keys in BuildConfig.
  • Treating Firebase API keys as authorization.
  • Logging user identifiers unnecessarily.
  • Opening rules for convenience.

Checklist

  • Secrets not committed.
  • Rules least-privilege.
  • Logs safe.
  • Permissions minimal.
  • Risks documented.

Example prompts

  • Use $super-android-kotlin-firebase to audit Firestore and Storage rules.
  • Use $super-android-kotlin-firebase to check this app for secret leaks.

Expected response style

Respond with: brief diagnosis, change plan, affected files, code or diff summary, validation commands, tests added or recommended, risks, and next step. For review tasks, lead with findings ordered by severity.

References

  • ../../docs/audits/FUENTES_LOCALES.md
  • references/android-firebase-security.md
  • templates/security-review-template.md

What ships with it: 2 files

866 B alongside SKILL.md

references/

templates/

Keep looking

Skills are one crate of 326,970. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.