# firebase-apk-scanner

Unpacks an Android APK, pulls out its Firebase config and probes databases, buckets and functions for open access. Built for mobile app security audits.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 5400 installs · ★ 7805
- Author: trailofbits
- License: CC-BY-SA-4.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/trailofbits/skills/tree/HEAD/plugins/firebase-apk-scanner/skills/firebase-apk-scanner/SKILL.md
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/skills/firebase-apk-scanner

## What it does

The skill runs `scanner.sh`, which decompiles an APK with apktool and gathers Firebase credentials from `google-services.json`, XML resources, assets, smali and DEX strings. Then it moves to live checks: unauthenticated read and write on Realtime Database, Firestore document access, Storage bucket listing, open signup, anonymous auth, email enumeration, Cloud Function calls and Remote Config exposure. Two reports come out — `scan_report.json` and a narrative `scan_report.txt`.

Test entries the scanner creates get removed afterwards. If anonymous auth succeeds, the token is kept so you can retry against rules that assume a signed-in user. Tool permissions stay narrow: `Bash` is limited to `scanner.sh`, `apktool` and `curl`, alongside file reads and grep.

Not every APK reaches the probing stage. When decompilation fails or no Firebase config turns up, a report is still written but the exit code is nonzero, and that file counts as untested rather than clean. Coverage has edges too: Cloud Functions are probed in `us-central1` only, while auth, functions and Remote Config are exercised against just the first project ID and API key extracted. Apps backed by several Firebase projects need a pass per config. The skill targets Android; iOS and web builds are out of scope.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill firebase-apk-scanner -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/firebase-apk-scanner/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/firebase-apk-scanner/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill firebase-apk-scanner -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/firebase-apk-scanner/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill firebase-apk-scanner -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/firebase-apk-scanner/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install trailofbits/skills firebase-apk-scanner
```

2. **Manually: put the files in place**
- File: `.github/skills/firebase-apk-scanner/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill firebase-apk-scanner -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/trailofbits/skills --path plugins/firebase-apk-scanner/skills/firebase-apk-scanner
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/firebase-apk-scanner/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill firebase-apk-scanner -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/trailofbits/skills/tree/HEAD/plugins/firebase-apk-scanner/skills/firebase-apk-scanner/SKILL.md

## When to use it
- find an open Realtime Database from a shipped APK
- check whether a Storage bucket accepts writes
- extract the Firebase project ID and API key from a compiled APK
- test unrestricted signup and anonymous auth
- enumerate Cloud Functions and hit them without a token

## Example prompts
- Scan `app-release.apk` for Firebase misconfigurations
- Run the scanner over the `apks/` folder and show me the report
- Does this APK have an open Realtime Database?

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [trailofbits/skills](https://affpapa.org/en/nevibecode/by/trailofbits/skills.md) — 77 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md