How are the findings reported?

The skill generates a structured summary including extracted project IDs, a list of vulnerabilities (Critical to Low), and specific remediation steps for each finding.

Is it safe to use on production apps?

You must only use this skill on applications where you have explicit, written authorization for security testing as it interacts with live endpoints.

What Firebase services are tested?

The scanner tests Realtime Database, Firestore, Cloud Storage, Authentication, Cloud Functions, and Remote Config for common misconfigurations.

Does this tool require the original source code?

No, it works directly with compiled APK files by decompiling them to extract configuration strings and test endpoints.

Firebase APK Security Scanner

Name: Firebase APK Security Scanner
Author: monmacllcapp

bymonmacllcapp

0•

Security & Testing

Scans Android APKs for Firebase security misconfigurations including open databases, storage buckets, and authentication vulnerabilities.

The Firebase APK Security Scanner is a specialized tool for security analysts and mobile developers to audit Android applications for critical backend misconfigurations. It automates the extraction of Firebase configurations from APK files and performs systematic testing of Realtime Database, Firestore, Cloud Storage, and Authentication endpoints to identify unauthenticated access or data leaks. By providing detailed vulnerability reports with severity classifications and remediation guidance, it helps teams secure their mobile backends against common security pitfalls before deployment.

Key Features

01Authentication bypass testing for anonymous auth and open signups

02Detailed vulnerability reporting with severity levels and fix guidance

030 GitHub stars

04Unauthenticated read/write testing for Realtime Database and Firestore

05Security auditing of Cloud Storage buckets and Cloud Functions

06Automated APK decompilation and Firebase configuration extraction

Use Cases

01Identifying leaked PII or sensitive data in Firebase-backed mobile apps

02Performing security audits on Android applications before production release

03Validating Firebase security rules during authorized penetration testing

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add monmacllcapp/skill-forks firebase-apk-scanner

For use in Claude.ai and ChatGPT

Download Skill