Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add kvdm-co-pilot/create-cmp --skill cmp-firebase-connectgit clone --depth 1 https://github.com/kvdm-co-pilot/create-cmpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kvdm-co-pilot/create-cmp/cmp-firebase-connect)<a href="https://agentmods.dev/skills/kvdm-co-pilot/create-cmp/cmp-firebase-connect"><img src="https://agentmods.dev/badge/skills/kvdm-co-pilot/create-cmp/cmp-firebase-connect/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kvdm-co-pilot/create-cmp/cmp-firebase-connect"><img src="https://agentmods.dev/badge/skills/kvdm-co-pilot/create-cmp/cmp-firebase-connect.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00195 | $0.03839 |
| Opus 5.5 | $0.00078 | $0.01536 |
| Sonnet 5.5 | $0.00039 | $0.00768 |
| Haiku 4.5 | $0.00019 | $0.00384 |
Grade A, and why
cmp-firebase-connect scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 24d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 236 lines — stays where its author put it; the contents beside it link to each section on GitHub.
cmp-firebase-connect — add Firebase to a stamped CMP app and wire it to its own project
Your job: take a CMP app create-cmp stamped — which carries no Firebase — add Firebase with
create-cmp add firebase, and connect it to a real Firebase project on the user's account,
using the Firebase CLI — no console clicking for anything the CLI can do. You finish by proving
the wiring with a green build.
The code edits are a program's, not yours.
create-cmp add firebaseadds the GitLive SDK, the google-services plugin, the debug-build emulator redirect and the config file, and refuses by name when the app's shape is one it does not recognise. Never hand-edit Gradle, the catalog or the entry points to wire Firebase; if the step refuses, report its message to the user.
Consent is a program in the stamped app; this skill does not restate it.
create-cmp add firebase(§1 step 4) shipsqa/hooks/firebase-consent.mjsand registers it in the app's.claude/settings.jsonas a PreToolUse hook: when a command would runprojects:create,apps:create,firestore:databases:createorapps:android:sha:create, Claude Code asks the user first, naming the mutation. The hook asks and never allows. Run the add step before any cloud command, so the hook is there when one runs.
Cost honesty. A fresh Firebase project starts on the Spark (free) plan. Nothing in this flow enables billing, attaches a card, or upgrades to Blaze — and the CLI cannot silently do so. Auth (email/phone within free quota), Firestore, and the free-tier services all work on Spark. Say this to the user up front so "create a cloud project" doesn't read as "spend money".
1. Preflight
Run these checks before touching anything; fix in order.
- CLI present —
firebase --version. If missing, offer (consent-gated — it's a global install on their machine):npm i -g firebase-tools, then re-check. - Logged in —
firebase login:list. If it reports no accounts, runfirebase login. Tell the user first: this opens an interactive browser OAuth flow they must complete themselves; you cannot do it for them. On a headless/remote box usefirebase login --no-localhost. Do not proceed untillogin:listshows an account. - Read the app's identity from the stamped project (never ask the user to retype what the
repo already knows):
- Android
applicationId— fromcomposeApp/build.gradle.kts(theapplicationId = "..."line insideandroid { defaultConfig { … } }). - iOS bundle id — from
iosApp/project.yml(PRODUCT_BUNDLE_IDENTIFIER/bundleIdPrefix). iOS is optional and currently deferred product-wide — do the Android wiring first and only take the iOS branch (§5) if the user explicitly wants it now.
- Android
- Add Firebase, if the app has none yet — read
create-cmp.json'sfirebaserecord.- Absent: run the add step. It edits only this repo's files, writes nothing until its whole plan is made, and changes nothing on a second run — tell the user what it does, then:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 24d ago Changed · +1 lines 11b8ea1fef2c
- 29d ago Changed · +32 lines · +25 tokens per session 1284a6baa4a1
- 1mo ago First seen · 203 lines · 170 tokens per session scan A 8225fe679c9a
cmp-firebase-connect is a skill published in the GitHub repository kvdm-co-pilot/create-cmp (0 stars, last pushed 3d ago), licensed MIT. It adds 195 tokens to every session and 3,839 once invoked, about $0.0008 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
offline-first
Offline-first architecture patterns - NetworkBoundResource, sync strategies, conflict resolution, cache invalidation, and connectivity monitoring.
cloudkit
Implement, review, or debug iCloud sync in iOS/macOS apps with CloudKit. Covers CKContainer + private/public/shared CKDatabase, CKRecord / CKRecord.Reference / CKAsset, CKQuery + CKQueryOperation, CKSubscription (query/database/recordZone) with silent push, CKSyncEngine (iOS 17+: state serialization…
compose-multiplatform
Use when building one shared Compose UI in Kotlin across Android, iOS, and desktop — commonMain @Composables, expect/actual, source-set placement, native interop, multiplatform ViewModel/navigation/Koin. NOT a single-platform native build (that is kotlin-android / swift-ios), and NOT Dart/Flutter cross-platform UI…
m3-expressive
Material 3 Expressive design patterns for Jetpack Compose - expressive theming, motion physics, shape morphing, typography emphasis, color emphasis, and all 28 expressive components.
liquid-glass
Apple Liquid Glass design patterns for SwiftUI iOS 26 - glass effects, morphing, containers, interactive glass, tinting, accessibility, and cross-platform glass design.
android-device-integrity
Android app/device integrity and anti-fraud for a fintech app — the Play Integrity API (com.google.android.play:integrity): Standard requests (StandardIntegrityManager.prepareIntegrityToken → StandardIntegrityTokenProvider.request with a requestHash → StandardIntegrityToken) vs Classic requests…