[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-firebase-firebase-security-rules-auditor":3,"mdc--xh3dos-key":38,"related-repo-firebase-firebase-security-rules-auditor":262,"related-org-firebase-firebase-security-rules-auditor":381},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":27,"repoUrl":28,"updatedAt":29,"license":30,"forks":31,"topics":32,"repo":33,"sourceUrl":36,"mdContent":37},"firebase-security-rules-auditor","audit Firestore security rules","Audits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege escalation, role bypasses, create vs update inconsistencies, resource exhaustion, type safety, size limits, and hasOnly ownership checks. Use when auditing\u002Freviewing rules, running red-team rule assessments, or scoring against auditor checklists. Don't use for Firebase CLI (login, deploy), Auth, Crashlytics, Remote Config, or database queries.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"firebase","Firebase (Google)","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Ffirebase.png",[12,16,19,22,25],{"name":13,"slug":14,"type":15},"Security","security","tag",{"name":17,"slug":18,"type":15},"Compliance","compliance",{"name":20,"slug":21,"type":15},"Audit","audit",{"name":23,"slug":24,"type":15},"Database","database",{"name":26,"slug":8,"type":15},"Firebase",376,"https:\u002F\u002Fgithub.com\u002Ffirebase\u002Fagent-skills","2026-07-31T05:53:16.588011",null,75,[],{"repoUrl":28,"stars":27,"forks":31,"topics":34,"description":35},[],"Agent Skills for Firebase","https:\u002F\u002Fgithub.com\u002Ffirebase\u002Fagent-skills\u002Ftree\u002FHEAD\u002Fskills\u002Ffirebase-security-rules-auditor","---\nname: firebase-security-rules-auditor\ndescription: >-\n  Audits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege escalation, role bypasses, create vs update inconsistencies, resource exhaustion, type safety, size limits, and hasOnly ownership checks. Use when auditing\u002Freviewing rules, running red-team rule assessments, or scoring against auditor checklists. Don't use for Firebase CLI (login, deploy), Auth, Crashlytics, Remote Config, or database queries.\n---\n\n# Overview\n\nThis skill acts as an auditor for Firebase Security Rules, evaluating them\nagainst a rigorous set of criteria to ensure they are secure, robust, and\ncorrectly implemented.\n\n# Scoring Criteria\n\n## Assessment: Security Validator (Red Team Edition)\n\nYou are a Senior Security Auditor and Penetration Tester specializing in\nFirestore. Your goal is to find \"the hole in the wall.\" Do not assume a rule is\nsecure because it looks complex; instead, actively try to find a sequence of\noperations to bypass it.\n\n### Mandatory Audit Checklist:\n\n1. **The Update Bypass:** Compare 'create' and 'update' rules. Can a user create\n   a valid document and then 'update' it into an invalid or malicious state\n   (e.g., changing their role, bypassing size limits, or corrupting data types)?\n1. **Authority Source:** Does the security rely on user-provided data\n   (request.resource.data) for sensitive fields like 'role', 'isAdmin', or\n   'ownerId'? Carefully consider the source for that authority.\n1. **Business Logic vs. Rules:** Does the rule set actually support the app's\n   purpose? (e.g., In a collaboration app, can collaborators actually read the\n   data? If not, the rules are \"broken\" or will force insecure workarounds).\n1. **Storage Abuse:** Are there string length or array size limits? If not,\n   label it as a \"Resource Exhaustion\u002FDoS\" risk.\n1. **Type Safety:** Are fields checked with 'is string', 'is int', or 'is\n   timestamp'?\n1. **Field-Level vs. Identity-Level Security:** Be careful with rules that use\n   \\`hasOnly()\\` or \\`diff()\\`. While these restrict *which* fields can be\n   updated, they do NOT restrict *who* can update them unless an ownership check\n   (e.g., \\`resource.data.uid == request.auth.uid\\`) is also present. If a rule\n   allows any authenticated user to update fields on another user's document\n   without a corresponding ownership check, it is a data integrity\n   vulnerability.\n\n### Admin Bootstrapping & Privileges:\n\nThe admin bootstrapping process is limited in this app. If the rules use a\nsingle hardcoded admin email (e.g., checking request.auth.token.email ==\n'admin@example.com'), this should NOT count against the score as long as:\n\n- email_verified is also checked (request.auth.token.email_verified == true).\n- It is implemented in a way that does not allow additional admins to add\n  themselves or leave an escalation risk open.\n\n### Scoring Criteria (1-5):\n\n- **1 (Critical):** Unauthorized data access (leaks), privilege escalation, or\n  total validation bypass.\n- **2 (Major):** Broken business logic, self-assigned roles, bypass of controls.\n- **3 (Moderate):** PII exposure (e.g., public emails), Inconsistent validation\n  (create vs update) on critical fields\n- **4 (Minor):** Problems that result in self-data corruption like update\n  bypasses that only impact the user's own data, lack of size limits, missing\n  minor type checks or over-permissive read access on non-sensitive fields.\n- **5 (Secure):** Comprehensive validation, strict ownership, and role-based\n  access via secure ACLs.\n\nReturn your assessment in JSON format using the following structure: { \"score\":\n1-5, \"summary\": \"overall assessment\", \"findings\": \\[ { \"check\": \"checklist\nitem\", \"severity\": \"critical|major|moderate|minor\", \"issue\": \"description\",\n\"recommendation\": \"fix\" } \\] }\n",{"data":39,"body":40},{"name":4,"description":6},{"type":41,"children":42},"root",[43,52,58,64,71,76,83,164,170,184,198,204,257],{"type":44,"tag":45,"props":46,"children":48},"element","h1",{"id":47},"overview",[49],{"type":50,"value":51},"text","Overview",{"type":44,"tag":53,"props":54,"children":55},"p",{},[56],{"type":50,"value":57},"This skill acts as an auditor for Firebase Security Rules, evaluating them\nagainst a rigorous set of criteria to ensure they are secure, robust, and\ncorrectly implemented.",{"type":44,"tag":45,"props":59,"children":61},{"id":60},"scoring-criteria",[62],{"type":50,"value":63},"Scoring Criteria",{"type":44,"tag":65,"props":66,"children":68},"h2",{"id":67},"assessment-security-validator-red-team-edition",[69],{"type":50,"value":70},"Assessment: Security Validator (Red Team Edition)",{"type":44,"tag":53,"props":72,"children":73},{},[74],{"type":50,"value":75},"You are a Senior Security Auditor and Penetration Tester specializing in\nFirestore. Your goal is to find \"the hole in the wall.\" Do not assume a rule is\nsecure because it looks complex; instead, actively try to find a sequence of\noperations to bypass it.",{"type":44,"tag":77,"props":78,"children":80},"h3",{"id":79},"mandatory-audit-checklist",[81],{"type":50,"value":82},"Mandatory Audit Checklist:",{"type":44,"tag":84,"props":85,"children":86},"ol",{},[87,99,109,119,129,139],{"type":44,"tag":88,"props":89,"children":90},"li",{},[91,97],{"type":44,"tag":92,"props":93,"children":94},"strong",{},[95],{"type":50,"value":96},"The Update Bypass:",{"type":50,"value":98}," Compare 'create' and 'update' rules. Can a user create\na valid document and then 'update' it into an invalid or malicious state\n(e.g., changing their role, bypassing size limits, or corrupting data types)?",{"type":44,"tag":88,"props":100,"children":101},{},[102,107],{"type":44,"tag":92,"props":103,"children":104},{},[105],{"type":50,"value":106},"Authority Source:",{"type":50,"value":108}," Does the security rely on user-provided data\n(request.resource.data) for sensitive fields like 'role', 'isAdmin', or\n'ownerId'? Carefully consider the source for that authority.",{"type":44,"tag":88,"props":110,"children":111},{},[112,117],{"type":44,"tag":92,"props":113,"children":114},{},[115],{"type":50,"value":116},"Business Logic vs. Rules:",{"type":50,"value":118}," Does the rule set actually support the app's\npurpose? (e.g., In a collaboration app, can collaborators actually read the\ndata? If not, the rules are \"broken\" or will force insecure workarounds).",{"type":44,"tag":88,"props":120,"children":121},{},[122,127],{"type":44,"tag":92,"props":123,"children":124},{},[125],{"type":50,"value":126},"Storage Abuse:",{"type":50,"value":128}," Are there string length or array size limits? If not,\nlabel it as a \"Resource Exhaustion\u002FDoS\" risk.",{"type":44,"tag":88,"props":130,"children":131},{},[132,137],{"type":44,"tag":92,"props":133,"children":134},{},[135],{"type":50,"value":136},"Type Safety:",{"type":50,"value":138}," Are fields checked with 'is string', 'is int', or 'is\ntimestamp'?",{"type":44,"tag":88,"props":140,"children":141},{},[142,147,149,155,157,162],{"type":44,"tag":92,"props":143,"children":144},{},[145],{"type":50,"value":146},"Field-Level vs. Identity-Level Security:",{"type":50,"value":148}," Be careful with rules that use\n`hasOnly()` or `diff()`. While these restrict ",{"type":44,"tag":150,"props":151,"children":152},"em",{},[153],{"type":50,"value":154},"which",{"type":50,"value":156}," fields can be\nupdated, they do NOT restrict ",{"type":44,"tag":150,"props":158,"children":159},{},[160],{"type":50,"value":161},"who",{"type":50,"value":163}," can update them unless an ownership check\n(e.g., `resource.data.uid == request.auth.uid`) is also present. If a rule\nallows any authenticated user to update fields on another user's document\nwithout a corresponding ownership check, it is a data integrity\nvulnerability.",{"type":44,"tag":77,"props":165,"children":167},{"id":166},"admin-bootstrapping-privileges",[168],{"type":50,"value":169},"Admin Bootstrapping & Privileges:",{"type":44,"tag":53,"props":171,"children":172},{},[173,175,182],{"type":50,"value":174},"The admin bootstrapping process is limited in this app. If the rules use a\nsingle hardcoded admin email (e.g., checking request.auth.token.email ==\n'",{"type":44,"tag":176,"props":177,"children":179},"a",{"href":178},"mailto:admin@example.com",[180],{"type":50,"value":181},"admin@example.com",{"type":50,"value":183},"'), this should NOT count against the score as long as:",{"type":44,"tag":185,"props":186,"children":187},"ul",{},[188,193],{"type":44,"tag":88,"props":189,"children":190},{},[191],{"type":50,"value":192},"email_verified is also checked (request.auth.token.email_verified == true).",{"type":44,"tag":88,"props":194,"children":195},{},[196],{"type":50,"value":197},"It is implemented in a way that does not allow additional admins to add\nthemselves or leave an escalation risk open.",{"type":44,"tag":77,"props":199,"children":201},{"id":200},"scoring-criteria-1-5",[202],{"type":50,"value":203},"Scoring Criteria (1-5):",{"type":44,"tag":185,"props":205,"children":206},{},[207,217,227,237,247],{"type":44,"tag":88,"props":208,"children":209},{},[210,215],{"type":44,"tag":92,"props":211,"children":212},{},[213],{"type":50,"value":214},"1 (Critical):",{"type":50,"value":216}," Unauthorized data access (leaks), privilege escalation, or\ntotal validation bypass.",{"type":44,"tag":88,"props":218,"children":219},{},[220,225],{"type":44,"tag":92,"props":221,"children":222},{},[223],{"type":50,"value":224},"2 (Major):",{"type":50,"value":226}," Broken business logic, self-assigned roles, bypass of controls.",{"type":44,"tag":88,"props":228,"children":229},{},[230,235],{"type":44,"tag":92,"props":231,"children":232},{},[233],{"type":50,"value":234},"3 (Moderate):",{"type":50,"value":236}," PII exposure (e.g., public emails), Inconsistent validation\n(create vs update) on critical fields",{"type":44,"tag":88,"props":238,"children":239},{},[240,245],{"type":44,"tag":92,"props":241,"children":242},{},[243],{"type":50,"value":244},"4 (Minor):",{"type":50,"value":246}," Problems that result in self-data corruption like update\nbypasses that only impact the user's own data, lack of size limits, missing\nminor type checks or over-permissive read access on non-sensitive fields.",{"type":44,"tag":88,"props":248,"children":249},{},[250,255],{"type":44,"tag":92,"props":251,"children":252},{},[253],{"type":50,"value":254},"5 (Secure):",{"type":50,"value":256}," Comprehensive validation, strict ownership, and role-based\naccess via secure ACLs.",{"type":44,"tag":53,"props":258,"children":259},{},[260],{"type":50,"value":261},"Return your assessment in JSON format using the following structure: { \"score\":\n1-5, \"summary\": \"overall assessment\", \"findings\": [ { \"check\": \"checklist\nitem\", \"severity\": \"critical|major|moderate|minor\", \"issue\": \"description\",\n\"recommendation\": \"fix\" } ] }",{"items":263,"total":380},[264,280,297,317,330,344,364],{"slug":265,"name":265,"fn":266,"description":267,"org":268,"tags":269,"stars":27,"repoUrl":28,"updatedAt":279},"extension-to-functions-codebase","convert Firebase Extensions to Cloud Functions","Skill for converting an installed Firebase Extension (or extension source) to a standalone Cloud Functions for Firebase codebase or publishable npm package, including upgrading triggers from V1 to V2 and configuring lifecycle hooks and declarative security",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[270,273,274,277],{"name":271,"slug":272,"type":15},"Cloud Functions","cloud-functions",{"name":26,"slug":8,"type":15},{"name":275,"slug":276,"type":15},"Migration","migration",{"name":278,"slug":278,"type":15},"npm","2026-07-31T06:23:32.436718",{"slug":281,"name":281,"fn":282,"description":283,"org":284,"tags":285,"stars":27,"repoUrl":28,"updatedAt":296},"firebase-ai-logic-basics","integrate Firebase AI Logic","Official skill for integrating Firebase AI Logic (Gemini API) into web applications. Covers setup, multimodal inference, structured output, and security.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[286,289,290,293],{"name":287,"slug":288,"type":15},"Backend","backend",{"name":26,"slug":8,"type":15},{"name":291,"slug":292,"type":15},"Gemini","gemini",{"name":294,"slug":295,"type":15},"LLM","llm","2026-07-31T05:53:23.557174",{"slug":298,"name":298,"fn":299,"description":300,"org":301,"tags":302,"stars":27,"repoUrl":28,"updatedAt":316},"firebase-app-hosting-basics","deploy web apps with Firebase App Hosting","Deploys and manages full-stack web applications (Next.js, Angular) with Server-Side Rendering (SSR) using Firebase App Hosting. Use when deploying Next.js\u002FAngular apps, configuring apphosting.yaml or firebase.json apphosting blocks, managing secrets, setting up GitHub CI\u002FCD, or configuring Blaze billing requirements. Don't use for classic static web hosting, Auth, Firestore, Crashlytics, or Xcode.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[303,306,309,310,313],{"name":304,"slug":305,"type":15},"Angular","angular",{"name":307,"slug":308,"type":15},"Deployment","deployment",{"name":26,"slug":8,"type":15},{"name":311,"slug":312,"type":15},"Frontend","frontend",{"name":314,"slug":315,"type":15},"Next.js","next-js","2026-07-31T05:53:19.57287",{"slug":318,"name":318,"fn":319,"description":320,"org":321,"tags":322,"stars":27,"repoUrl":28,"updatedAt":329},"firebase-auth-basics","set up Firebase Authentication","Guide for setting up and using Firebase Authentication. Use this skill when the user's app requires user sign-in, user management, or secure data access using auth rules.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[323,326,327,328],{"name":324,"slug":325,"type":15},"Auth","auth",{"name":287,"slug":288,"type":15},{"name":26,"slug":8,"type":15},{"name":13,"slug":14,"type":15},"2026-07-31T05:53:20.79137",{"slug":331,"name":331,"fn":332,"description":333,"org":334,"tags":335,"stars":27,"repoUrl":28,"updatedAt":343},"firebase-basics","build applications with Firebase","Provides foundational Firebase CLI setup, CLI installation, version checks (`firebase-tools@latest --version`), CLI login (including --no-localhost), project creation, project selection (`firebase use`), and app config file downloads (`google-services.json`, `GoogleService-Info.plist`). Use ONLY for CLI login, project creation\u002Fswitching, or downloading app config files. Don't use for Firebase Hosting deploy, Firestore, Auth, App Hosting, Data Connect, Crashlytics, or Remote Config.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[336,339,340,341,342],{"name":337,"slug":338,"type":15},"Authentication","authentication",{"name":287,"slug":288,"type":15},{"name":23,"slug":24,"type":15},{"name":307,"slug":308,"type":15},{"name":26,"slug":8,"type":15},"2026-07-31T05:53:21.570684",{"slug":345,"name":345,"fn":346,"description":347,"org":348,"tags":349,"stars":27,"repoUrl":28,"updatedAt":363},"firebase-crashlytics","set up and manage Firebase Crashlytics","Comprehensive guide for Firebase Crashlytics, including provisioning and SDK usage. Use this skill when the user needs help setting up Crashlytics, adding crash reporting, or using the Crashlytics SDK in their application.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[350,353,354,357,360],{"name":351,"slug":352,"type":15},"Android","android",{"name":26,"slug":8,"type":15},{"name":355,"slug":356,"type":15},"iOS","ios",{"name":358,"slug":359,"type":15},"Mobile","mobile",{"name":361,"slug":362,"type":15},"Observability","observability","2026-05-01T05:54:14.072678",{"slug":365,"name":365,"fn":366,"description":367,"org":368,"tags":369,"stars":27,"repoUrl":28,"updatedAt":379},"firebase-data-connect","build backends with Firebase Data Connect","Builds and deploys Firebase SQL Connect (aka Firebase Data Connect) backends with PostgreSQL securely. Use when designing schemas with tables and relations, writing authorized queries and mutations, configuring real-time data updates, or generating type-safe SDKs. Use when you need a relational database with Firebase, or when the user mentions SQL Connect or Data Connect.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[370,371,372,373,376],{"name":287,"slug":288,"type":15},{"name":23,"slug":24,"type":15},{"name":26,"slug":8,"type":15},{"name":374,"slug":375,"type":15},"GraphQL","graphql",{"name":377,"slug":378,"type":15},"PostgreSQL","postgresql","2026-04-06T18:12:07.681031",12,{"items":382,"total":380},[383,390,397,405,412,420,428,436,449,462,480,488],{"slug":265,"name":265,"fn":266,"description":267,"org":384,"tags":385,"stars":27,"repoUrl":28,"updatedAt":279},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[386,387,388,389],{"name":271,"slug":272,"type":15},{"name":26,"slug":8,"type":15},{"name":275,"slug":276,"type":15},{"name":278,"slug":278,"type":15},{"slug":281,"name":281,"fn":282,"description":283,"org":391,"tags":392,"stars":27,"repoUrl":28,"updatedAt":296},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[393,394,395,396],{"name":287,"slug":288,"type":15},{"name":26,"slug":8,"type":15},{"name":291,"slug":292,"type":15},{"name":294,"slug":295,"type":15},{"slug":298,"name":298,"fn":299,"description":300,"org":398,"tags":399,"stars":27,"repoUrl":28,"updatedAt":316},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[400,401,402,403,404],{"name":304,"slug":305,"type":15},{"name":307,"slug":308,"type":15},{"name":26,"slug":8,"type":15},{"name":311,"slug":312,"type":15},{"name":314,"slug":315,"type":15},{"slug":318,"name":318,"fn":319,"description":320,"org":406,"tags":407,"stars":27,"repoUrl":28,"updatedAt":329},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[408,409,410,411],{"name":324,"slug":325,"type":15},{"name":287,"slug":288,"type":15},{"name":26,"slug":8,"type":15},{"name":13,"slug":14,"type":15},{"slug":331,"name":331,"fn":332,"description":333,"org":413,"tags":414,"stars":27,"repoUrl":28,"updatedAt":343},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[415,416,417,418,419],{"name":337,"slug":338,"type":15},{"name":287,"slug":288,"type":15},{"name":23,"slug":24,"type":15},{"name":307,"slug":308,"type":15},{"name":26,"slug":8,"type":15},{"slug":345,"name":345,"fn":346,"description":347,"org":421,"tags":422,"stars":27,"repoUrl":28,"updatedAt":363},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[423,424,425,426,427],{"name":351,"slug":352,"type":15},{"name":26,"slug":8,"type":15},{"name":355,"slug":356,"type":15},{"name":358,"slug":359,"type":15},{"name":361,"slug":362,"type":15},{"slug":365,"name":365,"fn":366,"description":367,"org":429,"tags":430,"stars":27,"repoUrl":28,"updatedAt":379},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[431,432,433,434,435],{"name":287,"slug":288,"type":15},{"name":23,"slug":24,"type":15},{"name":26,"slug":8,"type":15},{"name":374,"slug":375,"type":15},{"name":377,"slug":378,"type":15},{"slug":437,"name":437,"fn":438,"description":439,"org":440,"tags":441,"stars":27,"repoUrl":28,"updatedAt":448},"firebase-firestore","manage and query Cloud Firestore databases","Sets up, manages, queries, and configures Cloud Firestore databases (Standard\u002FEnterprise edition), including data modeling, security rules, indexes, and SDK integrations (Web, Python, iOS, Android, Flutter). Use when creating\u002Flisting Firestore databases, defining data models\u002Findexes, writing SDK queries, or integrating Firestore SDKs. Don't use for Firebase Hosting, Data Connect, Auth, Storage\u002FGCS, Crashlytics, Functions, or BigQuery.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[442,443,444,445],{"name":287,"slug":288,"type":15},{"name":23,"slug":24,"type":15},{"name":26,"slug":8,"type":15},{"name":446,"slug":447,"type":15},"NoSQL","nosql","2026-07-31T05:53:17.562137",{"slug":450,"name":450,"fn":451,"description":452,"org":453,"tags":454,"stars":27,"repoUrl":28,"updatedAt":461},"firebase-hosting-basics","deploy static apps with Firebase Hosting","Deploys and configures classic Firebase Hosting for static websites, single-page apps (SPAs), and microservices. Use when deploying static sites\u002FSPAs, setting up custom domains, configuring firebase.json hosting settings (redirects, rewrites, headers, multi-site), or managing preview channels. Don't use for Firebase App Hosting (Next.js\u002FSSR), Auth, Firestore queries\u002Frules, Data Connect, or Crashlytics.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[455,456,457,458],{"name":307,"slug":308,"type":15},{"name":26,"slug":8,"type":15},{"name":311,"slug":312,"type":15},{"name":459,"slug":460,"type":15},"Web Development","web-development","2026-07-31T05:53:22.565034",{"slug":463,"name":463,"fn":464,"description":465,"org":466,"tags":467,"stars":27,"repoUrl":28,"updatedAt":479},"firebase-remote-config-basics","manage Firebase Remote Config and feature flags","Manages Firebase Remote Config templates, feature flags, loading strategies, and SDKs (Android, iOS). Use when downloading\u002Fdeploying remoteconfig JSON templates, managing version history\u002Ffeature flags, setting in-app defaults, fetchAndActivate(), real-time listeners, or SDK setup. Don't use for Firebase Hosting, Auth, Firestore, Data Connect, Crashlytics, or App Hosting.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[468,471,474,475,476],{"name":469,"slug":470,"type":15},"Configuration","configuration",{"name":472,"slug":473,"type":15},"Feature Flags","feature-flags",{"name":26,"slug":8,"type":15},{"name":358,"slug":359,"type":15},{"name":477,"slug":478,"type":15},"SDK","sdk","2026-07-31T05:53:18.552749",{"slug":4,"name":4,"fn":5,"description":6,"org":481,"tags":482,"stars":27,"repoUrl":28,"updatedAt":29},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[483,484,485,486,487],{"name":20,"slug":21,"type":15},{"name":17,"slug":18,"type":15},{"name":23,"slug":24,"type":15},{"name":26,"slug":8,"type":15},{"name":13,"slug":14,"type":15},{"slug":489,"name":489,"fn":490,"description":491,"org":492,"tags":493,"stars":27,"repoUrl":28,"updatedAt":502},"xcode-project-setup","manage Xcode project dependencies and packages","Safely modifies Xcode projects (.pbxproj) to add Swift Packages and link files. Use this skill whenever an iOS project needs dependencies installed (e.g. Firebase, Alamofire).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[494,495,496,499],{"name":355,"slug":356,"type":15},{"name":358,"slug":359,"type":15},{"name":497,"slug":498,"type":15},"Swift","swift",{"name":500,"slug":501,"type":15},"Xcode","xcode","2026-05-01T05:54:12.834251"]