firebase-apk-scanner

An agent skill by trailofbits, from trailofbits/skills. Tags: analysis, android, cloud, mobile, security.

What it does

Scans Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud functions. Use when analyzing APK files for Firebase vulnerabilities, performing mobile app security audits, or testing Firebase endpoint security. For authorized security research only.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add trailofbits/skills --skill firebase-apk-scanner

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/firebase-apk-scanner/skills/firebase-apk-scanner ~/.claude/skills/firebase-apk-scanner

Safety box score

Grade C, moderate risk: 44 of 100 risk points, rated 2026-10-15. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a shell-based APK scanner that decompiles Android apps and probes Firebase endpoints for Auth, Realtime Database, Firestore, Storage, Cloud Functions, and Remote Config issues. Its main risks are outbound network activity and automatic remote-side effects: it can create/delete test accounts and write/delete test data against live Firebase backends, while also saving extracted config and tokens to disk.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	`scanner.sh` is executable code that runs `apktool`, `curl`, `jq`, `grep`, `unzip`, `sed`, `awk`, and `strings` over user-supplied APKs.
Network access	2 (moderate)	It makes outbound requests to Google/Firebase APIs such as `identitytoolkit.googleapis.com`, `firestore.googleapis.com`, `firebasestorage.googleapis.com`, and `firebaseremoteconfig.googleapis.com`.
Filesystem reach	1 (low)	It writes reports under `firebase_scan_*`, decompiles APKs into a working directory, and removes only its own temp paths with `rm -rf "$DECOMPILED_DIR"` and `rm -rf "$dex_dir"`.
Secrets & credentials	2 (moderate)	The scanner extracts Firebase API keys/config and writes generated auth tokens to disk, e.g. `echo "ID_TOKEN:$id_token" >>"$result_file"` and copies `firebase_config.json` into results.
Privilege & persistence	1 (low)	The skill itself does not require sudo or system changes, but `scanner.sh` tells users to install dependencies with `brew install ...` or `sudo apt install ...`.
Instruction hijack surface	0 (none)	The files contain authorization caveats and testing guidance, but no instructions to ignore higher-level rules, fetch remote instructions, or hide actions from the user.
Irreversible actions	3 (high)	Running the scanner automatically creates/deletes remote Firebase accounts and writes/deletes test data without further confirmation, using endpoints like `accounts:signUp`, RTDB `PUT`, Firestore `POST`, and Storage upload/delete.
Transparency	0 (none)	All operational logic is visible in plain shell/Markdown; there are no binaries, packed payloads, or unpinned remote installers.

Before installing

Read `scanner.sh` and confirm you are okay with live Firebase write/delete tests.
Run it first on a disposable APK and throwaway Firebase project/account, not production.
Keep the scan output private if it may contain extracted API keys or generated `ID_TOKEN` values.
Verify `apktool`, `curl`, `jq`, and `strings` are already installed so you do not need system-wide package installs on your main machine.

Rated 2026-10-15 by an automated review of 6 files from the skill's repository.

Source

Repository: trailofbits/skills (all skills from this repository)
Path: plugins/firebase-apk-scanner/skills/firebase-apk-scanner/SKILL.md
Branch: main
Collection: firebase-apk-scanner
Updated: 2026-09-19

algorand-vulnerability-scanner — Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations.
audit-augmentation — Augments Trailmark code graphs with external audit findings from SARIF static analysis results, weAudit annotation files.
audit-context-building — Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere.
audit-prep-assistant — Prepares codebases for security review using Trail of Bits' checklist.
burpsuite-project-parser — Searches and explores Burp Suite project files (.burp) from the command line. Use when searching response headers or bodies with regex patterns.
c-review — Performs comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities.