mirror of
https://github.com/trailofbits/skills.git
synced 2026-09-14 14:28:48 +08:00
Dan Guido
922ec62527
* Fix firebase-apk-scanner scanner.sh path and command handoff
scanner.sh sat at the plugin root, but SKILL.md invoked it as
{baseDir}/scanner.sh, where {baseDir} is the skill directory, so the skill's
central action pointed at a nonexistent path. Move the script into
skills/firebase-apk-scanner/ with git mv so the path resolves; the SKILL.md
references are unchanged.
The firebase-apk-scanner skill sets disable-model-invocation: true, so the
model cannot invoke it and the command body's "Invoke the skill" instruction
was a dead end. Rework commands/scan-apk.md to read and follow the skill's
SKILL.md workflow directly, resolving the skill base directory via the plugin
root environment variable.
Fix README usage: the command is /trailofbits:scan-apk (not /firebase-scan),
and the standalone script path is now skills/firebase-apk-scanner/scanner.sh.
Bump version 2.1.1 -> 2.2.0.
Claude-Session: https://claude.ai/code/session_014UFqJu1ada7gXjD9peo1rX
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* firebase-apk-scanner: make the command reachable and stop reporting empty scans as clean
Claude Code ignores `name` in a command file, so `name: trailofbits:scan-apk`
never took effect and `/trailofbits:scan-apk` — the only entry point the README
documented — was unreachable. Commands namespace by plugin directory name, as
insecure-defaults already does with no `name` key, so drop the key and document
`/firebase-apk-scanner:scan-apk`.
A directory holding no .apk files ran the loop zero times and still printed
"Vulnerable: 0" in green at exit 0, and an APK that failed to decompile counted
toward "Total APKs" while counting toward nothing else, so "1 scanned, 0
vulnerable" covered an APK that was never tested. Both now fail: an empty
directory exits 1, an all-failed run exits 1, and a partial failure reports
"Failed to scan: N" and carries failed_apks in scan_report.json. The skill's
summary table gained the matching row. Also match *.APK, which was silently
skipped and fed the zero-item pass.
The summary block passed colors as printf arguments while the color variables
held a literal \033, so those lines printed the escape as four characters. Use
ANSI-C quoting so the variables carry real ESC bytes in both positions.
Give the command a plugin-root fallback and an abort, matching c-review, so it
does not dead-end under Codex where CLAUDE_PLUGIN_ROOT is unset, and say that
$ARGUMENTS in the workflow file is literal text to substitute rather than a
shell variable to expand.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014UFqJu1ada7gXjD9peo1rX
* firebase-apk-scanner: stop calling an untested APK secure
extract_firebase_config always writes a config file, emitting [] for every field
it found nothing for, so the CONFIG_FAILED branch only fires if the write itself
fails. The case that actually happens — the APK decompiles but carries no
Firebase config, because it is obfuscated or does not use Firebase — skipped
every endpoint test on its own guard, left apk_vulnerable false, and wrote
SECURE. Output was "Total APKs: 1 / Vulnerable: 0" in green at exit 0 with zero
endpoints probed, byte-identical to a real clean scan.
Detect the all-empty config, mark the APK NO_CONFIG, count it in UNTESTED_APKS,
and report it on its own line and as untested_apks in scan_report.json. A run
where every APK either failed or had no config now exits 1, since nothing was
tested. The skill's summary table gained the row and says what NO_CONFIG means.
Verified with a stub apktool that decompiles to an empty tree: before, exit 0
and status SECURE; after, exit 1, status NO_CONFIG, untested_apks 1.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014UFqJu1ada7gXjD9peo1rX
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: kz-tob <kara.zaffarano@trailofbits.com>
Firebase APK Security Scanner
Scan Android APKs for Firebase security misconfigurations including open databases, exposed storage buckets, and authentication bypasses.
When to Use
Use this skill when you need to:
- Audit Android applications for Firebase misconfigurations
- Test Firebase endpoints extracted from APKs (Realtime Database, Firestore, Storage)
- Check authentication security (open signup, anonymous auth, email enumeration)
- Enumerate Cloud Functions and test for unauthenticated access
- Perform mobile app security assessments involving Firebase backends
When NOT to Use
- Scanning apps you do not have explicit authorization to test
- Testing production Firebase projects without written permission
- When you only need to extract Firebase config without testing (use manual grep/strings instead)
- For non-Android targets (iOS, web apps) - this skill is APK-specific
- When the target app does not use Firebase
What It Does
This skill automates Firebase security testing for Android applications. When invoked, Claude will:
- Decompile the APK using apktool
- Extract Firebase configuration from all sources (google-services.json, XML resources, assets, smali code, DEX strings)
- Test authentication endpoints for misconfigurations
- Probe Realtime Database and Firestore for open read/write access
- Check Storage buckets for public listing and upload vulnerabilities
- Enumerate Cloud Functions and test accessibility
- Generate detailed reports with findings and remediation guidance
Key Features
- Supports native Android, React Native, Flutter, and Cordova apps
- Extracts config from 7+ sources including raw DEX binary strings
- Tests 14 distinct vulnerability categories
- Automatic cleanup of test data created during scans
- Detailed vulnerability reference documentation included
Installation
/plugin install trailofbits/skills/plugins/firebase-apk-scanner
Prerequisites
Install required dependencies before use:
macOS:
brew install apktool curl jq binutils
Ubuntu/Debian:
sudo apt install apktool curl jq unzip binutils
Usage
/firebase-apk-scanner:scan-apk ./app.apk
/firebase-apk-scanner:scan-apk ./apks/
Or run the standalone script directly, from the plugin directory:
./skills/firebase-apk-scanner/scanner.sh app.apk
./skills/firebase-apk-scanner/scanner.sh ./apks/ --no-cleanup
Vulnerability Categories
| Category | Tests | Severity |
|---|---|---|
| Authentication | Open signup, anonymous auth, email enumeration | Critical/High/Medium |
| Realtime Database | Unauthenticated read/write, auth token bypass | Critical/High |
| Firestore | Document access, collection enumeration | Critical/High |
| Storage | Bucket listing, unauthenticated upload | Critical/High |
| Cloud Functions | Unauthenticated access, function enumeration | Medium/Low |
| Remote Config | Public parameter exposure | Medium |