Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add e-t-y-b/etyb-skills --skill firebasegit clone --depth 1 https://github.com/e-t-y-b/etyb-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/e-t-y-b/etyb-skills/firebase)<a href="https://agentmods.dev/skills/e-t-y-b/etyb-skills/firebase"><img src="https://agentmods.dev/badge/skills/e-t-y-b/etyb-skills/firebase/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/e-t-y-b/etyb-skills/firebase"><img src="https://agentmods.dev/badge/skills/e-t-y-b/etyb-skills/firebase.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00205 | $0.03421 |
| Opus 5 | $0.00102 | $0.01710 |
| Sonnet 5 | $0.00041 | $0.00684 |
| Haiku 4.5 | $0.00020 | $0.00342 |
Grade A, and why
stack-firebase scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 127 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Firebase Stack — Team Briefing
This is a knowledge overlay, not a new specialist. The existing ETYB team does the work — backend-architect writes the backend code, devops-engineer wires the deploys, security-engineer enforces the boundary. This pack tells each role where the current Firebase knowledge lives.
Where the full briefing lives
The full Stack briefing lives in this same folder. Per-product and per-role pages are siblings of this SKILL.md. Every page carries last_verified_on stamps and authoritative-source URLs in its frontmatter; see skills/etyb/core/knowledge-currency.md for the drift-check protocol that uses them.
- Stack briefing:
stacks/firebase/index.md - Per-product pages:
stacks/firebase/<product>.md— one per entry inproducts_coveredabove - Per-role views:
stacks/firebase/<role>.md— one per role inapplies_to_rolesabove
When ETYB is installed locally these are read directly from disk. For third-party agents without the install, the same content is reachable as raw markdown at https://raw.githubusercontent.com/e-t-y-b/etyb-skills/main/stacks/firebase/<page>.md.
When delegate_to_skills (frontmatter above) lists a first-party vendor MCP/skill that's installed in the user's environment, ETYB defers to it first. The in-repo Stack content is the curated fallback.
What changed in 2025-2026 that older training data misses
Critical context — an LLM with a 2024 cutoff will get these wrong:
- Project IDX is now Firebase Studio (renamed 2025). Same product surface, new branding, deeper Firebase + Gemini integration. If you say "Project IDX" you're using the old name.
- Vertex AI in Firebase is now Firebase AI Logic (renamed 2025). The client-side Gemini SDK that talks to either Vertex AI or the Gemini Developer API behind App Check. The name change matters because the SDK packages were renamed too (
@firebase/aireplaces@firebase/vertexai). - Firebase App Hosting GA (2024) — the SSR-aware successor for Next.js and Angular. Cloud Run + Cloud Build under the hood, GitHub-integrated, replaces the brittle "Hosting + Cloud Functions rewrites" pattern that everyone built circa 2022.
- Firebase Data Connect GA (2024-2025) — managed Cloud SQL Postgres + GraphQL with generated, typed clients. Firebase now has a first-class relational option; "Firebase = NoSQL only" is out of date.
- Cloud Functions Gen 2 is the default for new functions, backed by Cloud Run with concurrent request handling, better cold-start economics, and a different deploy/runtime model. Gen 1 is on the deprecation roadmap — write all new code on v2 (
firebase-functions/v2). - Firestore multi-database per project (GA 2024). You can now provision multiple Firestore databases per project (named, distinct rules, distinct locations). This replaces "one project per database scope" workarounds.
- App Check Replay Protection (GA 2024) — single-use App Check tokens for callable functions, defending against captured-token replay. Worth enabling on every privileged path.
- FCM legacy HTTP and XMPP server APIs are deprecated. Use HTTP v1 API or the Admin SDK. Old code calling
fcm.googleapis.com/fcm/sendwith a server key will break — that endpoint was sunset. - Firebase Authentication ↔ Identity Platform convergence (2024-2025). The classic Firebase Auth tier and the paid Identity Platform tier (with MFA, SAML/OIDC SSO, advanced security) share the same surface and billing model now; "upgrading to Identity Platform" is a project toggle, not a re-architecture.
- Modular Web SDK is the only supported shape for
firebasev9+. Namespaced v8 imports (firebase.auth().signInWithEmailAndPassword(...)) are legacy and tree-shake badly. New code uses tree-shakable modular imports. - Genkit JS GA, with Python, Go, and Dart maturing through 2025-2026. Genkit's flow/tool/prompt API has churned multiple times — any sample older than mid-2024 likely has out-of-date shapes (
defineFlow→ai.defineFlowetc.).
What ships with it
31 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- ab-testing.md 5.2 KB
- ai-ml-engineer.md 10 KB
- app-check.md 7.7 KB
- app-distribution.md 4.2 KB
- backend-architect.md 12 KB
- cloud-firestore.md 9.4 KB
- cloud-functions-firebase.md 9.1 KB
- crashlytics.md 6.0 KB
- emulator-suite.md 6.5 KB
- fcm.md 7.8 KB
- firebase-ai-logic.md 8.8 KB
- firebase-analytics.md 6.8 KB
- firebase-app-hosting.md 6.9 KB
- firebase-auth.md 7.6 KB
- firebase-cli.md 7.0 KB
- firebase-data-connect.md 6.5 KB
- firebase-extensions.md 4.9 KB
- firebase-hosting.md 5.2 KB
- firebase-storage.md 6.4 KB
- firebase-studio.md 3.4 KB
- firebase-test-lab.md 4.8 KB
- frontend-architect.md 11 KB
- genkit.md 9.2 KB
- identity-platform.md 6.8 KB
- index.md 18 KB
- mobile-architect.md 13 KB
- performance-monitoring.md 4.8 KB
- realtime-database.md 4.8 KB
- remote-config.md 6.1 KB
- security-engineer.md 13 KB
- security-rules.md 8.9 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 127 lines · 205 tokens per session scan A 2ae5b4436590
stack-firebase is a skill published in the GitHub repository e-t-y-b/etyb-skills (10 stars, last pushed 2mo ago), licensed MIT. It adds 205 tokens to every session and 3,421 once invoked, about $0.0010 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
architecture-paradigm-cqrs-es
Applies CQRS and Event Sourcing for read/write separation and audit trails. Use when designing systems with complex domain logic or full state-change history.
supabase
Use this skill when developing applications with Supabase, running the Supabase CLI, designing migrations and RLS policies, testing database behavior, generating client types, deploying the official self-hosted Docker stack, or administering its Postgres, Auth, Storage, Realtime, Functions, API gateway, backups…
backend-cqrs-patterns
Use this skill when the user says 'CQRS', 'command query segregation', 'separate read write model', 'command model', 'query model', 'read model', 'write model', 'materialized view', 'command handler', 'query handler'. This skill enforces: strict command/query separation, write model optimized for consistency, read…
backend-event-sourcing
Use this skill when the user says 'event sourcing', 'event store', 'event stream', 'event sourced', 'rehydrate from events', 'event replay', 'projection rebuild', 'event log', 'append-only log', 'event history'. This skill enforces: events as the single source of truth, current state derived from event replay…
migration-evolution
Use when thinking through, reviewing, changing, or verifying data and contract evolution: schema migrations, expand-and-contract, resumable backfills, API or event compatibility, synchronization, CDC, reindexing, traffic cutover, or legacy integration. For outbox and inbox delivery use async-messaging; for transaction…
transactions-consistency
Use when thinking through, reviewing, changing, or verifying transactional or concurrent behavior: isolation, anomalies, locking, state machines, idempotency, sagas, consistency, replication, sharding, consensus, distributed locks, fencing, or ordering. For jobs, queues, and outbox delivery use async-messaging; for…