Firebase Tools is a command-line toolkit for testing, managing, and deploying Firebase projects, with an official MCP server for agent-based access. It is for developers working with Firebase Hosting, databases, Authentication, and other project resources, while the catalogue add-ons support agent workflows around these tools.
Borrowing it
Nothing to install: this file belongs to firebase/firebase-tools. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/firebase/firebase-tools/main/.agent/skills/firebase-tools-pr-review/SKILL.mdgit clone --depth 1 https://github.com/firebase/firebase-toolsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/firebase/firebase-tools/firebase-tools-pr-review)<a href="https://agentmods.dev/skills/firebase/firebase-tools/firebase-tools-pr-review"><img src="https://agentmods.dev/badge/skills/firebase/firebase-tools/firebase-tools-pr-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/firebase/firebase-tools/firebase-tools-pr-review"><img src="https://agentmods.dev/badge/skills/firebase/firebase-tools/firebase-tools-pr-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00077 | $0.02679 |
| Opus 5.5 | $0.00031 | $0.01072 |
| Sonnet 5.5 | $0.00015 | $0.00536 |
| Haiku 4.5 | $0.00008 | $0.00268 |
Grade A, and why
firebase-tools-pr-review scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
- **Rule**: Handlers executing child processes (`child_process.spawn`) must attach asynchronous `'error'` listeners and drain `stdout`/`stderr` streams to prevent buffer deadlocks. How it starts
The opening of the file, as written. The whole thing — 182 lines — stays where its author put it; the contents beside it link to each section on GitHub.
1. Quick Author & Reviewer Checklist
Before submitting or approving any PR on firebase/firebase-tools, verify:
- TypeScript Precision: No
anyoras any. Use generic parameters (client.request<T>()), explicit interfaces, orreadonly string[]for unmutated inputs. - No
null: Useundefinedor optional type annotations (string | undefined) instead ofnull. Drop redundant= undefinedinitializers. - CLI UX & Options Objects: Functions accept options objects rather than long positional argument lists. Command interfaces favor explicit flags over interactive pickers (CI safety).
- Clean CLI Initialization: No expensive background commands (e.g.
npx, sub-process execution) are triggered during CLI startup. - Error Remediation &
FirebaseError: Errors throwFirebaseErrorwith clear explanations and explicit remediation instructions (telling the user/agent what flag or tool to run). - Pristine
stdout(jqSafety): When--jsonis set, all logs, warnings, and spinners output tostderrsostdoutremains valid, parseable JSON. - Downgrade & Backward Safety: Disk state, emulator schemas, and CLI configs are backward-compatible to ensure developers can safely downgrade CLI versions.
- Testing Discipline: Unit tests exercise public APIs (
experiments.setEnabled) rather than stubbing private helpers. Mocks are cleaned up inafterEach(sinon.restore(),nock.cleanAll()). -
CHANGELOG.mdRules: User-facing bug fixes and new features include a changelog entry starting with a past-tense verb, with no[]annotations, and ending with(#<issue_number>)if applicable. Omit changelogs for unreleased flags or internal refactors. - No AI/Agent Junk: Unused comment blocks, residual issue numbers, or boilerplate generated by AI agents are stripped out.
2. Detailed Review Standards by Category
Category A: Code Style, Syntax & Anti-Patterns
- Strict Type Safety & Type Guard Functions
- Rule: Avoid
any,as any, or loose casting. Use generic type parameters at call sites (e.g.,client.request<T>()), explicit type guard functions (val is TargetType), or stepped assertions (as unknown as TargetType). - Immutability: Mark non-mutated array parameters as
readonly(e.g.,readonly string[]).
- Rule: Avoid
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 182 lines · 77 tokens per session scan A dc6241c17791
firebase-tools-pr-review is a skill published in the GitHub repository firebase/firebase-tools (4,484 stars, last pushed today), licensed MIT. It adds 77 tokens to every session and 2,679 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 1 finding (runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-29.
Other skills, from other repositories
no-bare-casts
Writing as in TypeScript or TSX production code, modifying a file that contains a bare as cast, silencing a type error with a cast, encountering as unknown as, or reviewing a cast site.
coding-standards
Universal coding standards, best practices, and patterns for TypeScript, JavaScript, React, and Node.js development.
splitting-oversized-modules
Split an oversized Python module (a thousand-plus-line logic.py, models.py, api.py, or its test file) into a package of one module per concern, mechanically and provably without changing behavior. Use on a request to split / break up / decompose a god module or move functions out of one, once a human has agreed to…
plankton-code-quality
Write-time code quality enforcement using Plankton — auto-formatting, linting, and Claude-powered fixes on every file edit via hooks.
best-practices
Language-specific best practices, code quality standards, and framework detection rules. Use when executing refactoring workflows, applying code quality rules, detecting frameworks, or checking language-specific patterns for TypeScript, Python, Go, Swift, or React.
code-review-typescript
Provides TypeScript-specific code review patterns covering strict mode, ESM, type safety, branded types, discriminated unions, async patterns, runtime safety, and common anti-patterns. Activates on detection of tsconfig.json, .ts, or .tsx files during code review — loaded automatically by dh:code-reviewer.