firebase-apk-scanner — Claude Code skill: Firebase audit for APKs

What firebase-apk-scanner does

The skill runs scanner.sh, which decompiles an APK with apktool and gathers Firebase credentials from google-services.json, XML resources, assets, smali and DEX strings. Then it moves to live checks: unauthenticated read and write on Realtime Database, Firestore document access, Storage bucket listing, open signup, anonymous auth, email enumeration, Cloud Function calls and Remote Config exposure. Two reports come out — scan_report.json and a narrative scan_report.txt.

Test entries the scanner creates get removed afterwards. If anonymous auth succeeds, the token is kept so you can retry against rules that assume a signed-in user. Tool permissions stay narrow: Bash is limited to scanner.sh, apktool and curl, alongside file reads and grep.

Not every APK reaches the probing stage. When decompilation fails or no Firebase config turns up, a report is still written but the exit code is nonzero, and that file counts as untested rather than clean. Coverage has edges too: Cloud Functions are probed in us-central1 only, while auth, functions and Remote Config are exercised against just the first project ID and API key extracted. Apps backed by several Firebase projects need a pass per config. The skill targets Android; iOS and web builds are out of scope.