mirror of
https://github.com/trailofbits/skills
synced 2026-06-21 14:12:00 +00:00
Lixin2026
d5fe2e6a78
* feat(codex): add skill UI metadata * Use official Trail of Bits logo * fix: resolve code review findings for PR #175 Codex silently drops the icons as authored: its loader (codex-rs/core-skills resolve_asset_path) requires icon paths containing '..' to resolve under <plugin_root>/assets/, and the repo-root .codex/assets location fails that containment check. Verified empirically via codex app-server plugin/read: every iconSmall/iconLarge came back null; only brand_color applied. P1 fixed: - Vendor trail-of-bits-mark.svg into plugins/<name>/assets/ for all 38 plugins with skills and point every openai.yaml at ../../assets/trail-of-bits-mark.svg (the supported plugin-level shared asset pattern). Icons now resolve for marketplace installs too, since nothing escapes the plugin root. - Drop the .codex/ additions: .codex/skills/gh-cli/agents/ openai.yaml resolved nowhere (.codex/skills is not a Codex discovery root) and PR #173 removes the whole .codex/ tree P2 fixed: - Patch-bump all 38 touched plugins in plugin.json and marketplace.json so installed clients pick up the metadata Verified: - Static check replicating Codex's resolution algorithm: all 73 yaml files resolve under their plugin assets/ and exist - Live codex app-server probe: 71/72 loadable skills report resolved iconSmall/iconLarge and brand_color #D83A34 (claude-in-chrome-troubleshooting fails to load on main due to a pre-existing 64-char qualified-name limit, fixed by #173's rename; zeroize-audit's manifest mcpServers object is likewise a pre-existing Codex incompatibility fixed by #173) - validate_codex_skills.py, validate_plugin_metadata.py, prek all pass Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(codex): use skill-local icon assets --------- Co-authored-by: Dan Guido <dan@trailofbits.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Firebase APK Security Scanner
Scan Android APKs for Firebase security misconfigurations including open databases, exposed storage buckets, and authentication bypasses.
When to Use
Use this skill when you need to:
- Audit Android applications for Firebase misconfigurations
- Test Firebase endpoints extracted from APKs (Realtime Database, Firestore, Storage)
- Check authentication security (open signup, anonymous auth, email enumeration)
- Enumerate Cloud Functions and test for unauthenticated access
- Perform mobile app security assessments involving Firebase backends
When NOT to Use
- Scanning apps you do not have explicit authorization to test
- Testing production Firebase projects without written permission
- When you only need to extract Firebase config without testing (use manual grep/strings instead)
- For non-Android targets (iOS, web apps) - this skill is APK-specific
- When the target app does not use Firebase
What It Does
This skill automates Firebase security testing for Android applications. When invoked, Claude will:
- Decompile the APK using apktool
- Extract Firebase configuration from all sources (google-services.json, XML resources, assets, smali code, DEX strings)
- Test authentication endpoints for misconfigurations
- Probe Realtime Database and Firestore for open read/write access
- Check Storage buckets for public listing and upload vulnerabilities
- Enumerate Cloud Functions and test accessibility
- Generate detailed reports with findings and remediation guidance
Key Features
- Supports native Android, React Native, Flutter, and Cordova apps
- Extracts config from 7+ sources including raw DEX binary strings
- Tests 14 distinct vulnerability categories
- Automatic cleanup of test data created during scans
- Detailed vulnerability reference documentation included
Installation
/plugin install trailofbits/skills/plugins/firebase-apk-scanner
Prerequisites
Install required dependencies before use:
macOS:
brew install apktool curl jq binutils
Ubuntu/Debian:
sudo apt install apktool curl jq unzip binutils
Usage
/firebase-scan ./app.apk
/firebase-scan ./apks/
Or run the standalone script directly:
./scanner.sh app.apk
./scanner.sh ./apks/ --no-cleanup
Vulnerability Categories
| Category | Tests | Severity |
|---|---|---|
| Authentication | Open signup, anonymous auth, email enumeration | Critical/High/Medium |
| Realtime Database | Unauthenticated read/write, auth token bypass | Critical/High |
| Firestore | Document access, collection enumeration | Critical/High |
| Storage | Bucket listing, unauthenticated upload | Critical/High |
| Cloud Functions | Unauthenticated access, function enumeration | Medium/Low |
| Remote Config | Public parameter exposure | Medium |