Scans Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud functions. Use when analyzing APK files for Firebase vuln
Install
The skill file stays in the publisher's repository.
Paste the copied command in a terminal. It installs this SKILL.md into that agent.
npx skills add trailofbits/skills --skill firebase-apk-scanner -a cursor -y
Scans Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud functions. Use when analyzing APK files for Firebase vulnerabilities, performing mobile app security audits, or testing Firebase endpoint security. For authorized security research only.
Questions
How do I install firebase-apk-scanner?
Download plugins/firebase-apk-scanner/skills/firebase-apk-scanner/SKILL.md from the publisher, or copy the path and open the repository. PlugMCP lists the skill and does not host the file.
Where does firebase-apk-scanner live?
The publisher keeps it at https://github.com/trailofbits/skills.
Which agents can use firebase-apk-scanner?
Claude, Cursor, and Codex can read a SKILL.md you add from the publisher's repository.
Scans Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud functions. Use when analyzing APK files for Firebase vulnerabilities, performing mobile app security audits, or testing Firebase endpoint security. For authorized security research only.
name: firebase-apk-scanner
description: Scans Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud functions. Use when analyzing APK files for Firebase vulnerabilities, performing mobile app security audits, or testing Firebase endpoint security. For authorized security research only.
argument-hint: [apk-file-or-directory]
allowed-tools: Bash({baseDir}/scanner.sh:) Bash(curl:*) Read Grep Glob
disable-model-invocation: true
) Bash(apktool:
Firebase APK Security Scanner
You are a Firebase security analyst. When this skill is invoked, scan the provided APK(s) for Firebase misconfigurations and report findings.
When to Use
Auditing Android applications for Firebase security misconfigurations
Testing Firebase endpoints extracted from APKs (Realtime Database, Firestore, Storage)
Enumerating Cloud Functions and testing for unauthenticated access
Mobile app security assessments involving Firebase backends
Authorized penetration testing of Firebase-backed applications
When NOT to Use
Scanning apps you do not have explicit authorization to test
Testing production Firebase projects without written permission
When you only need to extract Firebase config without testing (use manual grep/strings instead)
For non-Android targets (iOS, web apps) - this skill is APK-specific
When the target app does not use Firebase
Rationalizations to Reject
When auditing, reject these common rationalizations that lead to missed or downplayed findings:
"The database is read-only so it's fine" - Data exposure is still a critical finding; PII, API keys, and business data may be leaked
"It's just anonymous auth, not real accounts" - Anonymous tokens bypass auth != null rules and can access "authenticated-only" resources
"The API key is public anyway" - A public API key does not justify open database rules or disabled auth restrictions
"There's no sensitive data in there" - You cannot know what data will be stored in the future; insecure rules are vulnerabilities regardless of current content
"It's an internal app" - APKs can be extracted from any device; "internal" apps are not protected from reverse engineering
"We'll fix it before launch" - Document the finding; pre-launch vulnerabilities frequently ship to production
Reference Documentation
For detailed vulnerability patterns and exploitation techniques, consult:
The user will provide an APK file or directory: $ARGUMENTS
Workflow
Step 1: Validate Input
First, verify the target exists:
ls -la "$ARGUMENTS"
If $ARGUMENTS is empty, ask the user to provide an APK path.
Step 2: Run the Scanner
Execute the bundled scanner script on the target:
{baseDir}/scanner.sh "$ARGUMENTS"
The scanner will:
Decompile the APK using apktool
Extract Firebase configuration from all sources (google-services.json, XML resources, assets, smali code, DEX strings)
Test authentication endpoints (open signup, anonymous auth, email enumeration)
Test Realtime Database (unauthenticated read/write, auth bypass)
Test Firestore (document access, collection enumeration)
Test Storage buckets (listing, write access)
Test Cloud Functions (enumeration, unauthenticated access)
Test Remote Config exposure
Generate reports in text and JSON format
Step 3: Present Results
After the scanner completes, read scan_report.json (and scan_report.txt for
the narrative) in the exact directory it printed as Results saved to:. Do not
use a firebase_scan_* glob: it also matches every earlier scan in the current
directory.
The scanner exits nonzero after writing its report when no APK could be tested
(every APK failed to decompile or had no Firebase config). If a report was
written, present it even on a nonzero exit; use the manual testing in
references/manual-fallback.md only when no report exists.
State what the scanner did not cover: it probes Cloud Functions only in
us-central1, and tests auth, Cloud Functions and Remote Config only for the
first project ID and API key it extracted.
Present findings in this format:
Scan Summary
Metric
Value
APKs Scanned
X
Vulnerable
X
Failed to scan
X
No Firebase config
X
Total Issues
X
Take these from failed_apks and untested_apks in scan_report.json. Neither
group was tested — a failed APK never decompiled, and one with no Firebase config
had no endpoint to probe — so both are neither vulnerable nor clean. Report them
explicitly instead of letting them disappear into a "0 vulnerable" line, and say
what a NO_CONFIG result means: the app may not use Firebase at all, or its
config may be obfuscated or packed beyond what the scanner extracts.
Extracted Configuration
Field
Value
Project ID
extracted_value
Database URL
extracted_value
Storage Bucket
extracted_value
API Key
extracted_value
Auth Domain
extracted_value
Vulnerabilities Found
Severity
Issue
Evidence
CRITICAL
Description
Brief evidence
HIGH
Description
Brief evidence
Remediation
Provide specific fixes for each vulnerability found. Reference the Vulnerability Patterns for secure code examples.
LOW: Information disclosure without sensitive data
Important Guidelines
Authorization required - Only scan APKs you have permission to test
Clean up test data - The scanner automatically removes test entries it creates
Save tokens - If anonymous auth succeeds, use the token for authenticated bypass testing
Test all regions - Cloud Functions may be deployed to us-central1, europe-west1, asia-east1, etc.
Multiple instances - Some apps use multiple Firebase projects; test all discovered configurations
How do I install firebase-apk-scanner?
Download plugins/firebase-apk-scanner/skills/firebase-apk-scanner/SKILL.md from the publisher, or copy the path and open the repository. PlugMCP lists the skill and does not host the file.
Where does firebase-apk-scanner live?
The publisher keeps it at https://github.com/trailofbits/skills.
Which agents can use firebase-apk-scanner?
Claude, Cursor, and Codex can read a SKILL.md you add from the publisher's repository.