feat(marketplace): replace firebase submodule with local skills plugin - #273
Merged
Merged
Conversation
Remove the external-plugins/firebase submodule and ship firebase as a local built-in plugin at plugins/firebase. The new plugin bundles the Firebase MCP server (firebase-tools mcp --dir .) together with 13 skills vendored from firebase/agent-skills via skills.sh, exposed through the "skills" field in the plugin manifest. Marketplace entries (Claude, Codex, Cursor), release-please config and manifest, and the docs (README, CLAUDE.md, ARCHITECTURE.md) are updated accordingly.
amondnet
marked this pull request as ready for review
September 15, 2026 11:40
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Too many files changed for review (106 files, 100 file limit). Bypass the limit by tagging |
Up to standards ✅🟢 Issues
|
| Metric | Results |
|---|---|
| Duplication | 0 |
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Code Review
This pull request migrates the Firebase plugin from an external git submodule to a locally managed plugin under plugins/firebase. This change includes updating the plugin marketplace configurations, updating the project documentation, and adding the vendored Firebase agent skills under plugins/firebase/.agents/skills/ managed by skills-lock.json. There are no review comments provided, and we have no feedback to provide.
🔍 Tessl Skill Review
|
| Dimension | Score | Detail |
|---|---|---|
| conciseness | ████░ 4/5 | The body is directive and lean — rules and steps state what to do with compact code samples, without padding basic concepts Claude already knows. It is not a 5 because a few prose passages (e.g. the Target Workflows descriptions) could be tightened further. |
| actionability | ████░ 4/5 | It gives executable TypeScript/JSON examples and specific import paths and commands (onInit, requiresRole, onDocumentWritten), but a few areas (the exports map, README contents) stay descriptive rather than copy-paste ready. Not a 5 because of those minor gaps; not a 3 because most guidance is concrete and runnable. |
| workflow clarity | ███░░ 3/5 | The five-step migration sequence is clearly ordered, but there are no validation/verification checkpoints (no 'deploy and verify', 'run tests', or 'confirm triggers upgraded') on a batch migration, capping workflow clarity at 3 per the rubric. Not a 2 because the sequence itself is coherent and well-defined. |
| progressive disclosure | ███░░ 3/5 | The body is well-sectioned, but the three reference files (configuration-migration.md, destructuring-shim.md, signature-mapping.md) exist in the bundle yet are not explicitly linked or signalled from the body, so references are present but not clearly navigable. Not a 4 because the references are not clearly signalled; not a 2 because the body itself is reasonably structured. |
Suggestions:
- Add explicit validation/verification checkpoints to the workflow, e.g. a step to run the test suite and a 'deploy --only functions and confirm triggers upgraded' step before packaging.
- Link the existing reference files from the relevant body sections (e.g. 'See signature-mapping.md' under Step 3, 'destructuring-shim.md' where the shim is introduced).
- Make the package.json exports map and README content blocks fully copy-paste ready rather than descriptive, to close the actionability gaps.
Description Review
| Dimension | Score | Detail |
|---|---|---|
| specificity | █████ 5/5 | The description lists multiple concrete actions — converting a Firebase Extension into a Cloud Functions codebase or npm package, V1→V2 trigger upgrades, lifecycle hooks, and declarative security — giving comprehensive coverage rather than vague abstraction. |
| completeness | ███░░ 3/5 | It clearly answers 'what' the skill does but provides no 'Use when…' clause or equivalent explicit trigger guidance, so completeness is capped at 3 per the rubric guideline. It is not a 2 because the 'what' is clear and detailed rather than vague. |
| trigger term quality | ████░ 4/5 | It surfaces relevant domain keywords a user would say ('Firebase Extension', 'Cloud Functions for Firebase', 'npm package', 'V1 to V2'), but lacks common synonyms/variations and explicit file-type triggers. Not a 5 because coverage of natural phrasings is incomplete; not a 3 because the terms present are domain-appropriate and recognisable. |
| distinctiveness conflict risk | █████ 5/5 | The Firebase-Extension-to-Functions/npm-package migration niche is specific and unlikely to collide with other skills, giving minimal conflict risk. |
Suggestions:
- Append a 'Use when…' trigger clause, e.g. 'Use when migrating or converting a Firebase Extension to Cloud Functions for Firebase, upgrading V1 triggers to V2, or publishing an extension as an npm package.'
- Add natural trigger synonyms users might say (e.g. 'migrate', 'extract functions', 'Firebase extensions') to broaden trigger-term coverage.
- Optionally include trigger phrasing tied to file/resource cues (e.g. 'extension.yaml', 'functions/src') to improve natural discoverability.
plugins/firebase/.agents/skills/firebase-ai-logic-basics/SKILL.md
The body is well-structured with real reference files for platform-specific code and clear setup commands, but it leaves the core inference capabilities without inline executable examples and omits validation checkpoints in its workflows. Some overview padding and empty headers reduce conciseness.
Validation
⚠️ metadata_version — 'metadata.version' is missing⚠️ frontmatter_unknown_keys — Unknown frontmatter key(s) found; consider removing or moving to metadata
Full review details
Validation Checks
14/16 checks passed.
Review Details
| Dimension | Score | Detail |
|---|---|---|
| conciseness | ███░░ 3/5 | Most sections are terse with concrete commands, but the Overview carries marketing-style padding ('represents the evolution of Google's AI integration platform', 'previously known as Vertex AI for Firebase') and several headers are empty, so it could be tightened. |
| actionability | ███░░ 3/5 | Setup and App Check provide executable commands and config values, but the core inference capabilities (text, multimodal, chat, streaming, structured output, image generation, grounding) give only high-level hints with no inline executable code — the actual code is deferred to reference files. |
| workflow clarity | ███░░ 3/5 | Setup and App Check debug-token flows are sequenced with numbered steps, but there are no validation checkpoints (e.g. verify the Gemini Developer API was enabled, verify init succeeded), so checkpoints are missing or only implicit. |
| progressive disclosure | ████░ 4/5 | SKILL.md acts as an overview with one-level-deep references to real bundle files (usage_patterns_web.md, ios_setup.md, flutter_setup.md, usage_patterns_android.md) clearly listed in the References section, though the inline App Check debug-token detail and empty section headers are minor organization gaps. |
Suggestions:
- Add at least one short inline executable code snippet per core capability (text generation, multimodal, chat, streaming, structured output) instead of only descriptive hints.
- Insert validation checkpoints in the setup flow (e.g. 'Verify: the Gemini Developer API now shows Enabled in the Firebase console') and after
init ailogic. - Trim marketing language in the Overview and either fill or remove the empty section headers (Text-Only Generation, Search Grounding).
Description Review
| Dimension | Score | Detail |
|---|---|---|
| specificity | ████░ 4/5 | Names the domain ('integrating Firebase AI Logic (Gemini API) into web applications') and lists several concrete capability areas ('setup, multimodal inference, structured output, and security'), but omits chat, streaming, image generation, and grounding covered in the body, leaving minor gaps. |
| completeness | ███░░ 3/5 | Has a clear 'what' but no 'Use when...' clause or equivalent trigger guidance; per the rubric, a missing explicit trigger clause caps completeness at 3. |
| trigger term quality | ████░ 4/5 | Includes natural terms a user would say ('Gemini API', 'Firebase AI Logic', 'web applications') plus capability keywords, but misses common synonyms like 'Vertex AI for Firebase', 'Google AI', and bare 'Gemini'. |
| distinctiveness conflict risk | ████░ 4/5 | Targets a specific product niche (Firebase AI Logic / Gemini API) with minimal conflict risk, though it could overlap with a generic Gemini-API or broader Firebase skill. |
Suggestions:
- Add an explicit 'Use when...' clause, e.g. 'Use when integrating the Gemini API via Firebase AI Logic into a web, mobile, or Flutter app.'
- Include former-brand synonyms users may still say, such as 'Vertex AI for Firebase' and bare 'Gemini', to improve trigger matching.
- Reflect more of the body's capabilities (chat, streaming, image generation, search grounding) so specificity is comprehensive rather than partial.
plugins/firebase/.agents/skills/firebase-app-hosting-basics/SKILL.md
A well-structured overview that delegates detail to genuine reference files and gives concrete deploy commands. Its main weaknesses are the missing verification checkpoint in the deploy workflow and minor redundancy/underspecification.
Validation
⚠️ metadata_version — 'metadata.version' is missing
Full review details
Validation Checks
15/16 checks passed.
Review Details
| Dimension | Score | Detail |
|---|---|---|
| conciseness | ████░ 4/5 | Mostly efficient with concrete commands and a focused JSON example, but the opening 'This skill enables the agent to deploy and manage modern, full-stack web applications…' restates the frontmatter description, and the Hosting-vs-App-Hosting section is mildly explanatory rather than purely instructional. |
| actionability | ████░ 4/5 | Provides an executable firebase.json apphosting block and concrete npx -y firebase-tools@latest apphosting:secrets / deploy commands; the secrets step is slightly underspecified ('apphosting:secrets commands' rather than a named subcommand), keeping it just below fully copy-paste ready. |
| workflow clarity | ███░░ 3/5 | The 'Deploy from Source' section is a clear numbered sequence (configure firebase.json → apphosting.yaml → secrets → deploy), but there are no validation or verification checkpoints (e.g. confirming the rollout succeeded), which the rubric treats as missing checkpoints. |
| progressive disclosure | █████ 5/5 | The body is an overview that links one level deep to real, clearly-signaled reference files — references/configuration.md, references/cli_commands.md, and references/emulation.md (all verified to exist) — each referenced in context with its purpose. |
Suggestions:
- Add a verification step to the deploy workflow, e.g. 'Run
npx -y firebase-tools@latest apphosting:rollouts:list <backendId>and confirm the latest rollout is COMPLETED before considering the deploy done.' - Drop or trim the restated description paragraph ('This skill enables the agent to deploy and manage modern, full-stack web applications…') since the frontmatter description already covers it.
- Tighten the secrets step by naming the specific subcommand (e.g.
apphosting:secrets:set/apphosting:secrets:grantaccess) instead of the generic 'apphosting:secrets commands'.
Description Review
| Dimension | Score | Detail |
|---|---|---|
| specificity | █████ 5/5 | Names the domain and lists multiple concrete actions — 'Deploys and manages full-stack web applications', 'configuring apphosting.yaml', 'managing secrets', 'setting up GitHub CI/CD', 'configuring Blaze billing requirements' — for comprehensive coverage; not below 5 as no meaningful action is missing. |
| completeness | █████ 5/5 | Explicitly answers both 'what' ('Deploys and manages full-stack web applications… using Firebase App Hosting') and 'when' ('Use when deploying Next.js/Angular apps, configuring apphosting.yaml… managing secrets… GitHub CI/CD… Blaze billing'), with concrete trigger phrases and an exclusion clause. |
| trigger term quality | ████░ 4/5 | Good natural-term coverage ('Next.js', 'Angular', 'Server-Side Rendering (SSR)', 'apphosting.yaml', 'firebase.json apphosting blocks', 'GitHub CI/CD', 'Blaze billing'), but a few natural synonyms (e.g. 'SSR app', 'Angular SSR') are absent, so it sits below the comprehensive 5 anchor. |
| distinctiveness conflict risk | █████ 5/5 | Clear Firebase App Hosting niche with distinct triggers, plus an explicit 'Don't use for classic static web hosting, Auth, Firestore, Crashlytics, or Xcode' boundary that minimizes conflict risk. |
plugins/firebase/.agents/skills/firebase-auth-basics/SKILL.md
Well-structured with strong progressive disclosure and mostly executable guidance. The main weakness is conciseness: the Core Concepts section explains fundamentals Claude already knows, slightly diluting token efficiency.
Validation
⚠️ metadata_version — 'metadata.version' is missing
Full review details
Validation Checks
15/16 checks passed.
Review Details
| Dimension | Score | Detail |
|---|---|---|
| conciseness | ███░░ 3/5 | The body includes concept priming Claude already knows (defining users, listing identity providers, explaining ID/refresh tokens) that pads the overview; the actionable CLI/deploy sections are tight, but the Core Concepts section is unnecessary explanation. |
| actionability | ████░ 4/5 | Provisioning gives an executable firebase.json auth block and a concrete npx ... deploy --only auth command, and platform setup points to per-platform reference files; minor gaps are the console-only providers and the security-rules pointer being just a reference. |
| workflow clarity | ████░ 4/5 | The 3-step workflow (provision -> client setup -> security rules) is clearly sequenced with two numbered options and an explicit CRITICAL deploy step, but there is no validation checkpoint after deploy or for verifying the unauthorized-domain fix. |
| progressive disclosure | █████ 5/5 | SKILL.md is a lean overview that delegates bulk detail to one-level-deep, clearly signaled references (client_sdk_web.md, flutter_setup.md, client_sdk_android.md, security_rules.md), all of which are real bundle files; navigation is easy and content is appropriately split. |
Suggestions:
- Trim the Core Concepts section: drop the definitions of uid/email/displayName and the ID/refresh-token primer that Claude already knows, keeping only the provider list and the Google-recommendation note.
- Add a brief validation step after
deploy --only auth(e.g., confirm providers are enabled) to strengthen the workflow's feedback loop. - Link references/ios_setup.md from the Client Setup section or remove the unlinked file, so the bundle matches what the body references.
Description Review
| Dimension | Score | Detail |
|---|---|---|
| specificity | ████░ 4/5 | "setting up and using Firebase Authentication" plus "user sign-in, user management, or secure data access using auth rules" names the domain and several concrete actions, though coverage of auth actions is not exhaustive. |
| completeness | ████░ 4/5 | It answers both what ("setting up and using Firebase Authentication") and when ("Use this skill when the user's app requires user sign-in, user management, or secure data access"), with the 'when' being explicit but slightly generic rather than tied to concrete trigger phrases. |
| trigger term quality | ████░ 4/5 | "user sign-in", "user management", and "secure data access" are natural phrases users would say, with good keyword coverage, though common synonyms like "login" or "log in" are absent. |
| distinctiveness conflict risk | ████░ 4/5 | "Firebase Authentication" plus the specific auth-rule trigger carves a clear niche with minimal conflict risk against sibling skills, with only minor overlap with a general firebase-basics skill. |
plugins/firebase/.agents/skills/firebase-basics/SKILL.md
The body is highly actionable with concrete commands and a clear sequenced workflow, supported by well-organized references. Tightening the duplicated per-agent enumerations and fixing the missing claude refresh reference would raise the score.
Validation
⚠️ metadata_version — 'metadata.version' is missing⚠️ relative_links — Relative link issues: 1 missing, 13 deeper-than-1-level⚠️ referenced_paths_exist — Referenced path issues: 2 missing, 26 deeper-than-1-level
Full review details
Validation Checks
13/16 checks passed.
Review Details
| Dimension | Score | Detail |
|---|---|---|
| conciseness | ███░░ 3/5 | Mostly efficient and command-driven with little conceptual padding, but the per-agent setup and refresh reference enumerations are duplicated across two sections and some inline commentary could be tightened beyond a 'minor' level. |
| actionability | █████ 5/5 | Fully executable, copy-paste-ready commands (e.g. npx -y firebase-tools@latest login --no-localhost, projects:create, apps:sdkconfig ANDROID) with concrete flags covering the common cases. |
| workflow clarity | ████░ 4/5 | Clear sequenced prerequisites with branching for existing vs new projects and an agent pause-and-ask checkpoint; a few verification checkpoints are implicit rather than explicit, leaving minor gaps. |
| progressive disclosure | ████░ 4/5 | Good overview structure with well-signaled one-level-deep references split by setup/refresh/SDK init, all real bundle files except the cited references/refresh/claude.md which is missing from the bundle. |
Suggestions:
- Consolidate the duplicated per-agent setup and refresh reference lists into a single table or one shared reference to reduce verbosity.
- Add the missing
references/refresh/claude.mdfile (or correct the link to the existing refresh reference) so navigation is complete. - Make verification steps explicit commands (e.g. a checkable condition after
loginanduse) rather than prose like 'The command should output the current user'.
Description Review
| Dimension | Score | Detail |
|---|---|---|
| specificity | █████ 5/5 | Lists multiple concrete actions (CLI install, version check, login with --no-localhost, project creation, project selection via firebase use, config file downloads) with specific file types, giving comprehensive coverage. |
| completeness | █████ 5/5 | Explicitly answers both 'what' (the enumerated capabilities) and 'when' via 'Use ONLY for CLI login, project creation/switching, or downloading app config files', plus concrete negative-scope triggers. |
| trigger term quality | ████░ 4/5 | Strong natural tokens like 'login', 'project creation', 'config files', and the literal file names google-services.json/GoogleService-Info.plist; a few plain synonyms a user might say ('sign in', 'set up project') are absent. |
| distinctiveness conflict risk | █████ 5/5 | Clear niche reinforced by an explicit 'Use ONLY' clause and named exclusions (Hosting, Firestore, Auth, App Hosting, Data Connect, Crashlytics, Remote Config), keeping conflict risk minimal. |
plugins/firebase/.agents/skills/firebase-crashlytics/SKILL.md
The body is well-structured with excellent progressive disclosure, keeping the overview lean and pushing platform detail into reference files. It is held back by missing concrete commands in-body and no validation checkpoints in the setup workflow.
Validation
⚠️ metadata_version — 'metadata.version' is missing
Full review details
Validation Checks
15/16 checks passed.
Review Details
| Dimension | Score | Detail |
|---|---|---|
| conciseness | ████░ 4/5 | The body is lean and pointer-based, but mild filler like 'The SDK provides a number of features to make crash reports more actionable' and 'This skill provides a complete guide...' could be trimmed, keeping it just below a 5. |
| actionability | ███░░ 3/5 | It gives clear navigation to platform setup files, but the in-body guidance is incomplete — 'install the MCP server in the Firebase CLI' lacks the actual command, and SDK-usage detail is deferred to external docs without a concrete example. |
| workflow clarity | ███░░ 3/5 | Sections sequence the flow (Prerequisites → SDK Setup → SDK Usage), but there are no validation checkpoints to confirm Crashlytics is correctly provisioned or receiving reports. |
| progressive disclosure | █████ 5/5 | A concise overview points one level deep to real, well-signaled platform files (android_setup.md, ios_setup.md) and external customization docs; content is appropriately split and easy to navigate. |
Suggestions:
- Replace 'install the MCP server in the Firebase CLI' with the concrete invocation (e.g. the exact firebase CLI / MCP command) so the body is directly executable.
- Add a short verification checkpoint after SDK setup (e.g. how to confirm Crashlytics is receiving reports) to raise workflow clarity.
- Include one tiny inline code snippet for a common SDK-usage action (e.g. setting a custom key) rather than deferring everything to external docs.
Description Review
| Dimension | Score | Detail |
|---|---|---|
| specificity | ████░ 4/5 | Lists several concrete actions — 'provisioning and SDK usage', 'setting up Crashlytics', 'adding crash reporting', 'using the Crashlytics SDK' — but stops short of the exhaustive, multi-action coverage of a 5. |
| completeness | █████ 5/5 | Explicitly answers both what ('Comprehensive guide for Firebase Crashlytics, including provisioning and SDK usage') and when ('Use this skill when the user needs help setting up Crashlytics, adding crash reporting, or using the Crashlytics SDK'). |
| trigger term quality | ████░ 4/5 | Natural terms like 'setting up Crashlytics', 'adding crash reporting', and 'Crashlytics SDK' are present, but common synonyms (e.g. 'crash logs', 'crash data') are missing. |
| distinctiveness conflict risk | ████░ 4/5 | Crashlytics is a clearly scoped product niche with distinct triggers, but there is minor overlap risk with the sibling 'firebase-basics' skill referenced in the body. |
plugins/firebase/.agents/skills/firebase-data-connect/SKILL.md
A well-structured, mostly lean overview that delegates detail to clearly signaled one-level-deep reference files and includes concrete CLI commands and validation steps. Slight improvements possible in trimming the rename note and adding an explicit validation-failure retry loop.
Validation
⚠️ metadata_version — 'metadata.version' is missing⚠️ relative_links — Relative link issues: 25 missing
Full review details
Validation Checks
14/16 checks passed.
Review Details
| Dimension | Score | Detail |
|---|---|---|
| conciseness | ████░ 4/5 | Largely lean and purposeful with concrete commands and a tight structure, but the opening definitional paragraph and the multi-line 'Product Rename' note mildly restate context and could be trimmed. |
| actionability | ████░ 4/5 | Provides concrete, executable commands throughout (e.g. npx -y firebase-tools@latest dataconnect:compile, emulator start, deploy, init) and a complete YAML SDK-config block, with deeper GraphQL examples deferred to reference files — minor gaps only. |
| workflow clarity | ████░ 4/5 | A strict numbered workflow (define model → define operations → use SDK) and deployment steps with an explicit validation checkpoint (dataconnect:compile/sdk:generate to validate), though an explicit fix-and-retry feedback loop on validation failure is not spelled out. |
| progressive disclosure | ████░ 4/5 | Clear overview with well-signaled one-level-deep references and an excellent Feature Capability Map for navigation, but the referenced bundle files (reference/*, templates.md, examples.md) are not present in the review workspace to verify, and templates.md/examples.md sit at the repo root rather than under reference/ — minor organization gaps. |
Suggestions:
- Tighten the opening definitional paragraph and the 'Product Rename' note; the rename fact can be a one-liner since the name is already in the frontmatter.
- Add an explicit fix-and-revalidate feedback loop to the build/deploy workflows (e.g. 'if compile fails, fix schema/operations and re-run dataconnect:compile').
- Normalize reference file locations so templates.md and examples.md live under reference/ alongside the other reference files for consistent navigation.
Description Review
| Dimension | Score | Detail |
|---|---|---|
| specificity | █████ 5/5 | Lists multiple concrete actions — 'Builds and deploys... backends', 'designing schemas with tables and relations', 'writing authorized queries and mutations', 'configuring real-time data updates', 'generating type-safe SDKs' — giving comprehensive coverage of the skill's capabilities. |
| completeness | █████ 5/5 | Explicitly answers both 'what' ('Builds and deploys Firebase SQL Connect... backends with PostgreSQL securely') and 'when' with concrete trigger phrases ('Use when designing schemas...', 'Use when you need a relational database with Firebase, or when the user mentions SQL Connect or Data Connect'). |
| trigger term quality | ████░ 4/5 | Strong natural keywords with synonyms ('SQL Connect', 'Data Connect', 'relational database with Firebase'), but a few common variations users might say (e.g. 'GraphQL', 'Cloud SQL', '.gql') are absent. |
| distinctiveness conflict risk | █████ 5/5 | Clear niche (Firebase SQL Connect / Data Connect + PostgreSQL) with distinct product-name triggers, making overlap with unrelated skills minimal. |
plugins/firebase/.agents/skills/firebase-firestore/SKILL.md
A well-structured, concise orchestration body that routes by edition to real reference files. Its main gap is the absence of an explicit post-create validation checkpoint for a database provisioning operation.
Validation
⚠️ metadata_version — 'metadata.version' is missing⚠️ relative_links — Relative link issues: 14 deeper-than-1-level⚠️ referenced_paths_exist — Referenced path issues: 14 deeper-than-1-level
Full review details
Validation Checks
13/16 checks passed.
Review Details
| Dimension | Score | Detail |
|---|---|---|
| conciseness | █████ 5/5 | Lean and action-oriented with no padding or explanation of concepts Claude already knows; every line drives toward an action, matching the lean-and-efficient anchor. |
| actionability | ████░ 4/5 | Provides concrete executable commands (firestore:databases:list/get/locations/create with real flags), but code fences are malformed ('bash npx...' inline rather than fenced) and SDK code is delegated to references, leaving minor gaps. |
| workflow clarity | ███░░ 3/5 | Sequence is clear (detect edition, branch A/B, provision), but the database-creation step lacks an explicit success-validation/feedback loop; per the rubric cap, missing validation in database operations caps this at 3. |
| progressive disclosure | █████ 5/5 | Clear overview with well-signaled one-level-deep references into references/standard/ and references/enterprise/, all of which exist as real files, enabling easy navigation. |
Suggestions:
- Add an explicit validation step after
firestore:databases:create(e.g., re-runfirestore:databases:get <database-id>and confirm the edition/state) before proceeding to the guides, to satisfy the database-operations feedback-loop expectation. - Fix the malformed code fences: replace the inline
bash npx -y firebase-tools@latest ...text with proper triple-backtick fenced bash blocks so commands are copy-paste ready. - Make the edition-detection checkpoint explicit (e.g., a 'Verify the returned edition field' note) so the branch decision is a clear validation gate rather than an implicit read.
Description Review
| Dimension | Score | Detail |
|---|---|---|
| specificity | █████ 5/5 | Lists multiple concrete actions ('Sets up, manages, queries, and configures') plus comprehensive coverage areas (data modeling, security rules, indexes, SDK integrations across five platforms), matching the comprehensive-coverage anchor. |
| completeness | █████ 5/5 | Explicitly answers both 'what' (the setup/manage/query/configure capabilities) and 'when' ('Use when creating/listing...'), plus a concrete 'Don't use for...' boundary, matching the top anchor. |
| trigger term quality | ████░ 4/5 | Good natural-term coverage ('creating/listing Firestore databases', 'defining data models/indexes', 'writing SDK queries'), but a few common synonyms/variations are missing, placing it just below the comprehensive anchor. |
| distinctiveness conflict risk | █████ 5/5 | Clear Firestore niche with an explicit exclusion list (Hosting, Data Connect, Auth, Storage/GCS, Crashlytics, Functions, BigQuery), minimizing conflict risk with sibling Firebase skills. |
plugins/firebase/.agents/skills/firebase-hosting-basics/SKILL.md
The body is well-structured with clean progressive disclosure to real reference files and one inline executable command, but it is padded with conceptual/marketing content Claude already knows and lacks validation checkpoints in its deploy workflow. Tightening the overview and reordering emulation before deploy would lift the weaker dimensions.
Validation
⚠️ metadata_version — 'metadata.version' is missing
Full review details
Validation Checks
15/16 checks passed.
Review Details
| Dimension | Score | Detail |
|---|---|---|
| conciseness | ██░░░ 2/5 | Noticeably verbose: the Overview, Key Features bullets (CDN/SSL/marketing-style claims), and "Hosting vs App Hosting" section re-explain concepts Claude already knows and largely duplicate the description's negative boundary, fitting the score-2 anchor of several unnecessary padded sections; not a 3 because the padding is substantial rather than incidental. |
| actionability | ████░ 4/5 | Provides a concrete executable command ("npx -y firebase-tools@latest emulators:start --only hosting") inline and points to references that contain fully executable deploy/channel/clone commands and firebase.json examples, fitting the 4 anchor of mostly executable guidance with minor gaps; not a 5 because the body itself defers most commands to reference files rather than covering common cases inline. |
| workflow clarity | ███░░ 3/5 | Steps are numbered (Configuration, Deploying, Emulation) but there are no validation checkpoints, and Emulation (local testing) is listed after Deploying when it logically precedes a live deploy, fitting the 3 anchor of steps present but checkpoints missing/implicit; not a 4 because no verify step guards the outward-facing deploy. |
| progressive disclosure | ████░ 4/5 | Clear overview with well-signaled, verified one-level-deep references (configuration.md, deploying.md) that are real files with appropriately split detail, fitting the 4 anchor of good structure with minor organization gaps; not a 5 because inlined conceptual sections (Key Features, Hosting vs App Hosting) overlap the description rather than being pure overview-and-pointers. |
Suggestions:
- Trim the Overview, Key Features, and Hosting vs App Hosting sections to a few lines or remove them — these re-explain Firebase Hosting, CDN, and SSL concepts Claude already knows and duplicate the description's negative boundary.
- Reorder Emulation before Deploying so the workflow reads configure → test locally → deploy, and add an explicit verification checkpoint (e.g., confirm the preview URL loads, or run emulators:start before deploy).
- Inline one or two of the most common commands (e.g.,
firebase-tools@latest deploy --only hostingand a preview-channel deploy) directly in the body so the highest-frequency cases are actionable without opening a reference file.
Description Review
| Dimension | Score | Detail |
|---|---|---|
| specificity | █████ 5/5 | Lists multiple specific concrete actions — "Deploys and configures", "setting up custom domains", "configuring firebase.json hosting settings (redirects, rewrites, headers, multi-site)", and "managing preview channels" — giving comprehensive coverage, matching the score-5 anchor rather than the 4 anchor which allows coverage gaps. |
| completeness | █████ 5/5 | Explicitly answers what ("Deploys and configures classic Firebase Hosting for static websites, single-page apps (SPAs), and microservices") and when ("Use when deploying static sites/SPAs, setting up custom domains, configuring firebase.json hosting settings... or managing preview channels") with concrete trigger phrases, matching the 5 anchor; it is above 4 because both halves are concrete and explicit. |
| trigger term quality | █████ 5/5 | Natural phrases a user would say — "static sites/SPAs", "custom domains", "firebase.json", "redirects, rewrites, headers", "preview channels" — with synonyms (static websites / static sites, single-page apps / SPAs), matching comprehensive coverage rather than the 4 anchor that allows missing terms. |
| distinctiveness conflict risk | █████ 5/5 | A clear niche (classic Firebase Hosting) reinforced by an explicit negative boundary ("Don't use for Firebase App Hosting (Next.js/SSR), Auth, Firestore queries/rules, Data Connect, or Crashlytics") yields minimal conflict risk, matching the 5 anchor; above 4 because the exclusion list removes overlap with adjacent Firebase skills. |
plugins/firebase/.agents/skills/firebase-remote-config-basics/SKILL.md
Well-structured and actionable content with a clear, validated deployment workflow and good progressive disclosure through real reference files. The main defects are a verbatim duplicated section header/paragraph and a redundant trailing recap that waste tokens.
Validation
⚠️ metadata_version — 'metadata.version' is missing
Full review details
Validation Checks
15/16 checks passed.
Review Details
| Dimension | Score | Detail |
|---|---|---|
| conciseness | ███░░ 3/5 | Mostly efficient and command-focused, but the '### Template Management via CLI' header and its intro paragraph are duplicated verbatim (lines 69-77) and the trailing recap (lines 120-128) reiterates already-covered points, so it could be tightened. |
| actionability | ████░ 4/5 | Provides copy-paste-ready CLI commands (remoteconfig:get, deploy --only remoteconfig, remoteconfig:versions:list) and a firebase.json snippet, but the 'Autonomous Editing & Discovery' guidance on updating conditions/parameters stays high-level rather than showing a concrete edit. |
| workflow clarity | ████░ 4/5 | The template flow is clearly sequenced (get → edit → MANDATORY user-review checkpoint → deploy → verify versions) with validation present, and the troubleshooting section adds error recovery; the only gap is an explicit retry loop if deployment itself fails. |
| progressive disclosure | █████ 5/5 | SKILL.md is an overview that delegates platform SDK setup to real, clearly-linked, one-level-deep reference files (references/android_setup.md, references/ios_setup.md), with content appropriately split for easy navigation. |
Suggestions:
- Remove the duplicated '### Template Management via CLI' header and its identical intro paragraph (one of the two occurrences at lines 69-77).
- Trim or cut the trailing recap (lines 120-128) that re-lists Set In-App Defaults, Fetch and Activate, and Template Management already covered above.
- Add a brief 'If deploy fails' recovery step (e.g., re-run with --project, check login) to make the deployment workflow's feedback loop explicit.
Description Review
| Dimension | Score | Detail |
|---|---|---|
| specificity | █████ 5/5 | Enumerates multiple concrete actions — 'downloading/deploying remoteconfig JSON templates, managing version history/feature flags, setting in-app defaults, fetchAndActivate(), real-time listeners, or SDK setup' — giving comprehensive coverage of the skill's capabilities. |
| completeness | █████ 5/5 | Explicitly states what ('Manages Firebase Remote Config templates, feature flags, loading strategies, and SDKs') and when ('Use when downloading/deploying...'), with concrete trigger phrases and a negative boundary list. |
| trigger term quality | ████░ 4/5 | Good keyword coverage with natural terms like 'feature flags', 'remoteconfig JSON templates', and 'real-time listeners', but the set leans technical and omits common synonyms a user might say, falling just short of comprehensive. |
| distinctiveness conflict risk | █████ 5/5 | Clear niche (Firebase Remote Config) with explicit positive triggers and a 'Don't use for Firebase Hosting, Auth, Firestore, Data Connect, Crashlytics, or App Hosting' boundary, minimizing conflict with sibling Firebase skills. |
plugins/firebase/.agents/skills/firebase-security-rules-auditor/SKILL.md
The content delivers a focused, actionable red-team audit checklist with concrete field names and a structured JSON output format, but lacks an explicit validation/verification checkpoint in the audit workflow. Organization is clean with no nested references, though the duplicated 'Scoring Criteria' heading is a minor blemish.
Validation
⚠️ metadata_version — 'metadata.version' is missing
Full review details
Validation Checks
15/16 checks passed.
Review Details
| Dimension | Score | Detail |
|---|---|---|
| conciseness | ████░ 4/5 | The body is mostly lean — a checklist, scoring bands, and a JSON output schema — and does not explain concepts Claude already knows (e.g., it never defines what Firebase is). A few framing sentences ('Do not assume a rule is secure because it looks complex...') could be trimmed, keeping it just above the 'efficient, minor over-explanation' anchor rather than fully lean. |
| actionability | ████░ 4/5 | Concrete, specific guidance is given throughout: named checks ('Compare create and update rules'), real field names (request.resource.data.role, isAdmin, ownerId), rule functions (hasOnly(), diff()), an ownership pattern (resource.data.uid == request.auth.uid), and a complete JSON output schema. It stops short of fully copy-paste-ready worked examples, placing it at 'mostly executable guidance with minor gaps'. |
| workflow clarity | ███░░ 3/5 | The six numbered checklist items and the 1–5 scoring bands provide a clear sequence, but there is no validation/verification checkpoint or fix-and-retry feedback loop in the audit workflow itself — the auditor is told what to check but not how to confirm coverage before emitting the final JSON. This matches the 'steps listed but checkpoints missing' anchor. |
| progressive disclosure | ████░ 4/5 | No bundle files exist and the body is well-organized into clearly labeled sections (Overview, Scoring Criteria, Mandatory Audit Checklist, Admin Bootstrapping, Scoring Criteria, output schema) with no nested references. It slightly exceeds the under-50-line simple-skill carve-out and has minor organization gaps (two sections both titled 'Scoring Criteria'), so it sits at 'good structure, minor gaps' rather than a clean 5. |
Suggestions:
- Add a validation/verification step to the workflow — e.g., 'Before emitting the JSON, confirm each of the six checklist items was evaluated; if any check could not be assessed, mark it and explain why' — to lift workflow clarity above 3.
- Resolve the duplicated 'Scoring Criteria' heading (lines 15 and 57): rename the first to 'Assessment Approach' or similar so the section structure is unambiguous.
- Optionally include one short worked example of applying the checklist to a small rules snippet and the resulting JSON, which would move actionability from mostly-executable to fully copy-paste-ready.
Description Review
| Dimension | Score | Detail |
|---|---|---|
| specificity | █████ 5/5 | Lists multiple concrete audit actions — 'vulnerabilities, privilege escalation, role bypasses, create vs update inconsistencies, resource exhaustion, type safety, size limits, and hasOnly ownership checks' — giving comprehensive coverage rather than vague domain naming. |
| completeness | █████ 5/5 | Explicitly answers both 'what' (audits Firebase security rules for the enumerated flaw classes) and 'when' (an explicit 'Use when auditing/reviewing rules...' clause), with concrete trigger phrases. |
| trigger term quality | █████ 5/5 | Natural user phrases like 'auditing/reviewing rules', 'red-team rule assessments', and 'scoring against auditor checklists' appear alongside domain terms (Firestore, Cloud Storage), covering synonyms and common phrasings a user would actually say. |
| distinctiveness conflict risk | █████ 5/5 | Occupies a clear niche (Firebase security rules auditing) and adds an explicit 'Don't use for Firebase CLI (login, deploy), Auth, Crashlytics, Remote Config, or database queries' boundary, minimizing overlap with adjacent skills. |
plugins/firebase/.agents/skills/firestore-rules-creation/SKILL.md
A thorough, highly actionable rules-generation workflow with strong validation and feedback loops, but it is verbose with repeated reinforcement and inlines substantial reference-style material (helper functions, pattern catalog) that would benefit from being split into separate files.
Validation
⚠️ skill_md_line_count — SKILL.md is long (585 lines); consider splitting into references/ and linking⚠️ metadata_version — 'metadata.version' is missing
Full review details
Validation Checks
14/16 checks passed.
Review Details
| Dimension | Score | Detail |
|---|---|---|
| conciseness | ███░░ 3/5 | Mostly domain-specific guidance rather than general padding, but the ~570-line body repeats the validator-pattern, PII, and ownership-trap guidance across Phase-2, Critical Directives, and Phase-3, and inlines a ~125-line helper-function block that could be tightened or moved out. |
| actionability | ████░ 4/5 | Provides concrete copy-paste helper functions, bad/good RBAC examples, a complete getAfter()-based counter-update validator, and a dry-run command; minor gaps are the trailing '...' in some allow-rule examples and template placeholders like '[name]'. |
| workflow clarity | █████ 5/5 | Four clearly sequenced phases with explicit validation (Phase-3's 20-vector devil's-advocate checklist), a feedback loop ('Repeat Phase-3 until no attacks succeed'), and Phase-4 syntactic validation via 'firebase deploy --only firestore:rules --dry-run'. |
| progressive disclosure | ███░░ 3/5 | Section headings and phases give reasonable structure, but no references/scripts/assets bundle exists, so the large helper-function catalog and detailed pattern directives are all inlined in SKILL.md rather than split into one-level-deep reference files. |
Suggestions:
- Move the ~125-line helper-function catalog and the detailed pattern/attack-vector lists into a references/ file (e.g., references/helpers.rules and references/attack-vectors.md), keeping SKILL.md an overview that links to them — this improves both conciseness and progressive_disclosure.
- De-duplicate the validator-pattern, PII-exposure, and ownership-update-trap guidance that recurs across Phase-2, Critical Directives, and Phase-3; state each principle once and have Phase-3 reference it as a checklist item.
- Complete the illustrative allow-rule examples (replace trailing '...' with a concrete condition) so every code block is copy-paste runnable.
Description Review
| Dimension | Score | Detail |
|---|---|---|
| specificity | █████ 5/5 | Lists multiple concrete actions — 'Designs, authors, refactors, and hardens' plus 'writing schema/domain validators, preventing update bypasses, enforcing type safety and resource limits, or implementing role-based access control' — giving comprehensive coverage of the skill's capabilities. |
| completeness | █████ 5/5 | Explicitly answers 'what' ('Designs, authors, refactors, and hardens production-grade Cloud Firestore Security Rules') and 'when' ('Use when creating security rules...') with concrete trigger phrases and a negative boundary clause. |
| trigger term quality | ████░ 4/5 | Includes natural triggers like 'creating security rules', 'implementing role-based access control', and the file extension 'firestore.rules', but omits a few synonyms a user might say (e.g., 'Firestore permissions', 'database/collection rules'). |
| distinctiveness conflict risk | █████ 5/5 | Clear Firestore-security-rules niche with explicit disambiguation ('Don't use for security rules auditing (use firebase-security-rules-auditor), database provisioning, or client SDK queries') minimizing conflict risk. |
plugins/firebase/.agents/skills/xcode-project-setup/SKILL.md
The body is actionable and well-structured with a real bundled Swift script, but loses points for verbosity and for modifying a destructive project file without an explicit post-run validation feedback loop.
Validation
⚠️ metadata_version — 'metadata.version' is missing
Full review details
Validation Checks
15/16 checks passed.
Review Details
| Dimension | Score | Detail |
|---|---|---|
| conciseness | ███░░ 3/5 | Mostly efficient with concrete commands, but padded with unnecessary emphasis ("hefty fee"), a verbose Anti-Ruby mandate, and explanatory prose about folder synchronization that Claude already knows. |
| actionability | ████░ 4/5 | Provides a concrete swift run command with full signature and two complete copy-paste examples, with only minor placeholder gaps like <PATH_TO_SKILL>. |
| workflow clarity | ███░░ 3/5 | Has a toolchain verification gate and an empty-directory workflow, but performs destructive .pbxproj modification without a post-run validation/feedback loop, capping this dimension at 3 per the rubric. |
| progressive disclosure | ████░ 4/5 | Well-organized into clear sections with a one-level-deep reference to a real bundled script (scripts/xcode_spm_setup, confirmed present), though some detail could be further externalized. |
Suggestions:
- Trim padded prose and unnecessary emphasis (e.g. "hefty fee", verbose Anti-Ruby mandate) to respect the token budget.
- Add a post-run validation/verification step (e.g. re-open the .pbxproj or confirm the package appears) with a fix-and-retry loop, since .pbxproj modification is destructive.
- Move the lengthy Firebase linker-flag rationale into a separate reference file so the main body stays a lean overview.
Description Review
| Dimension | Score | Detail |
|---|---|---|
| specificity | ████░ 4/5 | Names the domain and several concrete actions ("modifies Xcode projects (.pbxproj)", "add Swift Packages", "link files") with only minor coverage gaps such as plist linking not being mentioned. |
| completeness | █████ 5/5 | Explicitly answers both what ("Safely modifies Xcode projects (.pbxproj) to add Swift Packages and link files") and when ("Use this skill whenever an iOS project needs dependencies installed") with concrete triggers. |
| trigger term quality | ████░ 4/5 | Includes natural terms users would say ("Xcode projects", "Swift Packages", "iOS project", "dependencies installed", "Firebase", "Alamofire") with a few synonyms/extensions missing. |
| distinctiveness conflict risk | █████ 5/5 | Occupies a clear niche (Xcode .pbxproj / SPM dependency setup) with named example packages, minimizing overlap with other skills. |
To improve your score, point your agent at the Tessl optimization guide. Need help? Jump on our Discord.
Feedback
Report issues with this review at tesslio/skill-review, or send private feedback from your terminal with tessl feedback.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Replaces the
firebaseexternal submodule plugin with a local built-in plugin that combines the Firebase MCP server with the official Firebase Agent Skills.Removed the submodule
git submodule deinit+git rmonexternal-plugins/firebase, its.gitmodulesentry, and the module dir under.git/modules/.idea/vcs.xmlmappingNew
plugins/firebase/.claude-plugin/plugin.json— Firebase MCP server (npx -y firebase-tools mcp --dir ., envIS_FIREBASE_MCP=true) plus"skills": "./.agents/skills/". Metadata follows upstreamfirebase/firebase-tools(.claude-plugin/marketplace.json) andfirebase/agent-skills; license Apache-2.0.bunx skills add firebase/agent-skills --skill '*' --agent universal -yrun from inside the plugin dir, producing.agents/skills/+skills-lock.json. No file copying; updatable viabunx skills update.README.mddocumenting the MCP server, the skill table, and the vendored-skill maintenance rule.Marketplace + companions (per
.claude/rules/marketplace-sync.md).claude-plugin/marketplace.json: firebase sourcegithub: pleaseai/firebase-plugin→./plugins/firebase; description/keywords/tags refreshed; therelevanceblock kept as-is.bun scripts/cli.ts multi-format, generating the Codex/Antigravity/Cursor manifests +.mcp.json/mcp_config.jsonand updating both generated marketplaces.release-please-config.json+.release-please-manifest.json: addedplugins/firebaseat 1.0.0, withextra-filescovering all four version-bearing manifests.README.mdmoved Firebase from External → Built-in Plugins (entry + install list);CLAUDE.mdandARCHITECTURE.mddropped the external-plugin references.Note for reviewers — diff scoping
multi-formatrewrites all 74 local plugins, exactly as the marketplace-sync rule warns. The unrelated churn was reverted (git restore plugins/, plus two strayplugins/portone/files), so the two generated marketplace diffs are firebase-only.bun.lockhas a pre-existing unrelated modification (a gatekeeper version bump) that was present before this work — deliberately left uncommitted.Related issue
None — no open issue tracks this change.
Verification
claude plugin validate plugins/firebase→ passedclaude plugin validate .claude-plugin/marketplace.json→ passed (13 warnings, all pre-existing on other plugins)bunx vitest run scripts/→ 132 passed. Required buildingpackages/vitest-configfirst, whosedist/was missing — a pre-existing environment gap, not caused by this change.Follow-ups (out of scope)
.claude/commands/add-gemini-extension.md:9still usespleaseai/firebase-pluginas its usage example (that repo still exists upstream)..idea/vcs.xmlretains other stale mappings from earlier plugin removals.Checklist
bun run test) — no new tests; existingbunx vitest run scripts/passes (132)bun run lint) — not run; change is manifests/docs onlyBREAKING CHANGE:note is includedSummary by cubic
Replaces the
firebaseexternal submodule with a local built-in plugin atplugins/firebasethat bundles the Firebase MCP server and 13 skills vendored fromfirebase/agent-skills. The submodule, its.gitmodulesentry, and its.idea/vcs.xmlmapping are removed; installs now resolve to the local plugin.Diff scoping for reviewers
multi-formatrewrites all 74 local plugins; unrelated churn was reverted, so the generated marketplace diffs are firebase-only.bun.lockcarries a pre-existing unrelated gatekeeper bump left uncommitted..claude/commands/add-gemini-extension.mdstill usespleaseai/firebase-pluginas its usage example.claude plugin validatepasses andbunx vitest run scripts/passes (132 tests).Written for commit 6aef156. Summary will update on new commits.