Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add alivirgo/Major-AI-Skills --skill firebasegit clone --depth 1 https://github.com/alivirgo/Major-AI-SkillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/alivirgo/major-ai-skills/firebase)<a href="https://agentmods.dev/skills/alivirgo/major-ai-skills/firebase"><img src="https://agentmods.dev/badge/skills/alivirgo/major-ai-skills/firebase/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/alivirgo/major-ai-skills/firebase"><img src="https://agentmods.dev/badge/skills/alivirgo/major-ai-skills/firebase.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00040 | $0.01976 |
| Opus 5.5 | $0.00016 | $0.00790 |
| Sonnet 5.5 | $0.00008 | $0.00395 |
| Haiku 4.5 | $0.00004 | $0.00198 |
Grade A, and why
firebase scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 191 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Firebase Platform AI Skill Guide (Claude)
Overview & Engine Architecture
Firebase sits on a Google Cloud project: Auth, Firestore / Realtime Database, Storage, Cloud Functions, Hosting, and FCM. Client config is public; authorization is Security Rules + ID tokens, not obscurity. The Admin SDK bypasses Rules and must stay server-only. Agents write Rules first, test with the Emulator Suite, never set FIREBASE_AUTH_EMULATOR_HOST in production, and remember the Firestore emulator does not enforce composite indexes.
┌─────────────────────────────────────────────────────────────┐
│ Firebase client → data plane │
│ │
│ Client SDKs (web / iOS / Android / Flutter) │
│ ├── Public firebaseConfig (apiKey is not a secret) │
│ └── ID token → Auth │
│ │
│ Firestore / Storage │
│ ├── Security Rules (request.auth, resource.data, claims) │
│ └── Indexes required in prod (emulator may skip) │
│ │
│ Trusted server │
│ ├── Cloud Functions / your backend + Admin SDK │
│ ├── Custom claims (small; force token refresh) │
│ └── FCM (no full emulator — can hit real messaging) │
└─────────────────────────────────────────────────────────────┘
When to use / when not to
Use when
- Adding Auth + Firestore/Storage to mobile/web apps with Rules and Emulator tests.
- Implementing callable/HTTP Cloud Functions with least-privilege service accounts.
- Wiring FCM with server-side sends and careful prod/emulator boundaries.
Do not use when
- You need relational SQL, joins, and Postgres RLS as the primary model →
@supabase. - The task is only deploying a static/Next frontend with no Firebase backend →
@vercel/@nextjs. - Someone asks for
allow read, write: if truein production, embedding service-account JSON in apps, or inventing GCP keys → refuse.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago Changed · +90 lines · +16 tokens per session f7ba34e7309d
- 1mo ago Changed · -7 tokens per session 154655abdac6
- 1mo ago First seen · 101 lines · 31 tokens per session scan A 5fe8ab603f79
firebase is a skill published in the GitHub repository alivirgo/Major-AI-Skills (2 stars, last pushed yesterday), licensed MIT. It adds 40 tokens to every session and 1,976 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-05.
Other skills, from other repositories
firebase
Use when building on Firebase — Firestore data modeling, Security Rules, Auth and custom claims, Cloud Functions, Storage, modular Web/Admin SDK imports — including symptoms like a database open to the internet, a query rejected by rules, or a doc stuck at 1 write/sec. NOT managed-Postgres BaaS with SQL and RLS (that…
api-rate-limit-handler
Implement bounded, idempotency-aware API throttling, backoff, and retry handling for 429 and transient 5xx responses.
api-endpoint-builder
Builds reviewable REST API endpoint scaffolds with validation, error handling, authentication, and documentation. Follows best practices for security and scalability.
api-contract-testing
Design and review API contract tests across providers and consumers. Use for schema changes, compatibility regressions and client integration failures.
firestore-better-auth
Use Firestore as the database adapter for Better Auth (Firebase Admin SDK). Use when storing Better Auth users, sessions, accounts, and verification tokens in Firestore, migrating from Auth.js/NextAuth Firebase adapter to Better Auth, setting up Better Auth with a Firebase/Firestore backend, upgrading a…
algolia-search-v2
Algolia Search Integration workflow skill. Use this skill when the user needs Expert patterns for Algolia search implementation, indexing and the operator should preserve the upstream workflow, copied support files, and provenance before merging or handing off.