Firebase
CloudCommonly used with
Skills using Firebase (291)
moai-domain-database
Database specialist covering PostgreSQL, MongoDB, Redis, Oracle, and cloud database platforms (Neon, Supabase, Firestore). Use for schema design, query optimization, indexing strategies, data modeling, or cloud database selection. Cloud vendor guide absorbed from moai-platform-database-cloud.
moai-platform-auth
Authentication and authorization specialist covering Auth0, Clerk, and Firebase Auth. Use when implementing authentication, MFA, SSO, passkeys, WebAuthn, social login, or security features.
moai-platform-database-cloud
Cloud database platform specialist covering Neon (serverless PostgreSQL), Supabase (PostgreSQL 16 with real-time), and Firebase Firestore (NoSQL with offline sync). Use when choosing or setting up cloud databases.
apk-redteam-pipeline
End-to-end Android APK red-team pipeline — automated APK acquisition (Play Store + apkpure + apkmirror fallback), jadx decompilation, secret/URL/JWT/Firebase grep, pinned-cert extraction, exported-component enumeration, Frida runtime instrumentation templates, intent-injection probes. Built from an authorized external red-team engagement where 7 APKs were pulled manually, 4 download attempts truncated, and a hardcoded JWT + 30 internal API endpoints were recovered from one of the apps. Use when target has a mobile app catalogue (Play Store developer page), when you find an APK URL hosted on a web server, or when post-recon mentions "mobile app" in scope.
hunt-cloud-misconfig
Hunt cloud / infrastructure misconfigurations. AWS: public S3 buckets (s3:GetObject anonymous), permissive bucket policies (PutObjectAcl public-write), exposed CloudFront origin, public Lambda function URL, public RDS snapshot, IAM credentials in JS bundles, AWS metadata accessible via SSRF. GCP: public GCS buckets, exposed Cloud Run services, leaked service account JSON. Azure: public blob containers, exposed Function App. (Kubernetes/Docker exposure is owned by hunt-k8s; CI/CD pipeline attacks by hunt-cicd; post-credential IAM escalation by cloud-iam-deep.) Detection: targeted dorking, certificate transparency, JS bundle secret extraction, port scan for known service ports. Validate: actual data read / write / RCE. Use when hunting cloud-native storage and compute misconfig (S3/GCS/Blob, IMDS-via-SSRF, serverless, public managed services).
vibe-build
Build your MVP following the AGENTS.md plan. Use when the user wants to start building, implement features, or says "build my MVP", "start coding", or "implement the project".
offensive-mobile
Mobile (Android + iOS) application penetration testing methodology. Covers static analysis (apktool/jadx for Android, class-dump/Hopper/IDA for iOS), dynamic instrumentation with Frida and Objection, SSL pinning bypass strategies, root/jailbreak detection bypass, deep-link / URL-scheme abuse, exported component attacks (Android activities, services, providers, receivers; iOS XPC, URL schemes, universal links), insecure data storage (SharedPrefs, KeyStore misuse, NSUserDefaults, Keychain ACL bypass), IPC / Intent redirection, WebView vulnerabilities (JavaScriptInterface, file:// access), Firebase/AWS/Azure misconfiguration leakage, mobile API testing, biometric/Face ID/Touch ID bypass, app-cloning and runtime patching, and mobile malware/RAT analysis primitives. Use for mobile pentest, bug bounty mobile triage, or app-store reconnaissance.
firebase-ai
Use when setting up firebase_ai, generating text/chat with Gemini, streaming AI output, building multimodal prompts, or handling AI errors.
firebase-analytics
Use when logging analytics events, setting user properties, configuring default event parameters, building funnels, or adding screen-view tracking.
firebase-app-check
Use when implementing app attestation, configuring App Check providers, setting up debug tokens, enabling backend enforcement, or managing token refresh.
firebase-auth
Use when setting up auth, managing auth state, implementing email/password or social sign-in, handling auth errors, or managing users.
firebase-cloud-firestore
Use when setting up Firestore, designing schemas, doing CRUD, creating listeners, paginating queries, configuring indexes, enabling offline persistence, or writing security rules.
firebase-cloud-functions
Use when calling callable functions (httpsCallable), passing data to server-side logic, handling function errors/timeouts, configuring regions, or testing with the Emulator Suite.
firebase-crashlytics
Use when implementing crash reporting, capturing fatal/non-fatal errors, recording isolate/async exceptions, customizing reports, or uploading obfuscated symbols.
firebase-data-connect
Use when setting up Data Connect, writing GraphQL queries/mutations, configuring generated SDKs, handling offline, or applying security rules.
firebase-database
Use when syncing real-time data, structuring JSON trees, reading/writing, creating listeners, enabling offline persistence, managing presence, sharding, or writing security rules.
firebase-in-app-messaging
Use when running in-app message campaigns, triggering/suppressing messages, configuring opt-in data collection, testing on specific devices, or handling message callbacks.
firebase-messaging
Use when setting up Firebase Cloud Messaging, managing permissions and tokens, handling background/foreground notification taps, or dispatching messages server-side (HTTP v1).
firebase-remote-config
Use when implementing feature flags, running A/B tests, setting parameter defaults, fetching/activating config, or enabling real-time config updates.
firebase-storage
Use when setting up Storage, uploading/downloading files, managing metadata, handling errors, or applying security rules.
flutterfire-configure
Use when adding Firebase to a Flutter project, running flutterfire configure, initializing Firebase in main.dart, or configuring multiple flavors.
generate-images-with-firebase-ai
Use when generating or editing images from Flutter/Dart with Firebase AI Logic and a Gemini image model (Nano Banana), making the first call work, choosing Gemini Developer API vs Vertex AI, hitting quota, billing or App Check failures, getting empty or image-only responses, sending a user photo as input, controlling aspect ratio or size, writing the image prompt, or deciding what to test.
analytics-setup
Generates protocol-based analytics infrastructure with swappable providers (TelemetryDeck, Firebase, Mixpanel). Use when user wants to add analytics, track events, or set up telemetry.
announcement-banner
Generates an in-app announcement banner system with remote configuration, scheduling, deep link actions, and dismiss tracking. Use when user wants in-app banners, promotional notices, maintenance alerts, or contextual announcements.
error-monitoring
Generates protocol-based error/crash monitoring with swappable providers (Sentry, Crashlytics). Use when user wants to add crash reporting, error tracking, or production monitoring.
feature-flags
Generate feature flag infrastructure with local defaults, remote configuration, SwiftUI integration, and debug menu. Use when adding feature flags or A/B testing to iOS/macOS apps.
cloud-deploy-gcp-aws
Use when a web/frontend app needs a cloud deploy - GitHub Actions to Cloud Run/App Runner for SSR or GCS+CDN/Firebase and S3+CloudFront for static, with build-time env and cache invalidation
launchworthy
Production readiness audit that turns a demo into a real product. Built for apps shipped fast with AI coding tools (Lovable, Bolt, v0, Cursor, Claude Code). Auto-detects your stack and audits 5 domains (Frontend, Backend & Data, Auth & Security, Infrastructure, Operations), then produces a scored scorecard and a prioritized punch list with exact file paths and copy-paste fixes. Use before you go live, or on an app that is already live, when the user says "harden this", "is this production ready", "is this safe to launch", "will this survive real users", "audit my app", "turn this into a product", "production audit", "is my supabase secure", or wants to go from demo to production.
firebase-security-expert
Firebase security expert to audit Security Rules (Firestore/Realtime Database/Storage), authentication, API keys, data leakage prevention, and App Check configuration / Ahli keamanan Firebase untuk audit Security Rules (Firestore/Realtime Database/Storage), autentikasi, API keys, pencegahan kebocoran data, dan konfigurasi App Check.
offensive-mobile
Mobile (Android + iOS) application penetration testing methodology. Covers static analysis (apktool/jadx for Android, class-dump/Hopper/IDA for iOS), dynamic instrumentation with Frida and Objection, SSL pinning bypass strategies, root/jailbreak detection bypass, deep-link / URL-scheme abuse, exported component attacks (Android activities, services, providers, receivers; iOS XPC, URL schemes, universal links), insecure data storage (SharedPrefs, KeyStore misuse, NSUserDefaults, Keychain ACL bypass), IPC / Intent redirection, WebView vulnerabilities (JavaScriptInterface, file:// access), Firebase/AWS/Azure misconfiguration leakage, mobile API testing, biometric/Face ID/Touch ID bypass, app-cloning and runtime patching, and mobile malware/RAT analysis primitives. Use for mobile pentest, bug bounty mobile triage, or app-store reconnaissance.
firebase-deploy
Deploy the ontology-atlas static site to Firebase Hosting from this repo. Use when the user asks to deploy, redeploy, publish the site, update Firebase Hosting, or verify the live web.app URL. The workflow must read `.env.prod`, build the static export, deploy only Hosting, and verify the live URL. Never commit `.env.prod` or introduce Firebase backend services.
qa-testing-mobile
Mobile QA for iOS and Android. Use when planning automation frameworks, device matrix, flake control, or CI/CD release gates.
cohesivity
Backend and infra for a project via Cohesivity (cohesivity.ai). Provisions Postgres, hosting and deploys, auth and social login, realtime websockets, an agent-native email inbox, object and vector storage, Redis, cron, and AI model APIs (OpenAI, Anthropic, Deepgram, Exa) through one HTTP API. Use when a valid `.cohesivity` file exists, a Cohesivity MCP is available, the user names Cohesivity, or the project needs a backend or any of these services and no competing provider was chosen.
expo-api-routes
Guidelines for creating API routes in Expo Router with EAS Hosting
moai-domain-database
Database specialist covering PostgreSQL, MongoDB, Redis, Oracle, and cloud database platforms (Neon, Supabase, Firestore). Use for schema design, query optimization, indexing strategies, data modeling, or cloud database selection. Cloud vendor guide absorbed from moai-platform-database-cloud.
crashlytics
Generate crash reports from Firebase Crashlytics with automated fix proposals, severity scoring, and developer assignments via git blame. Use when analyzing crashes, triaging production issues, or generating crash triage reports.
revenue-check
Pull product revenue per app from Firestore (or fixtures) and produce a cash-flow report
seo-ai-site-builders
Turn a JavaScript-only site built by an AI website generator into indexable HTML. Input: a site made with Lovable, Base44, Bolt, v0, Replit, Firebase Studio, Framer, Wix, Durable, Softr, Bubble, Glide or any similar tool. Output: proof of what crawlers actually receive (bundled zero-dependency script), the right conversion route (native SSR, build-time prerendering or SSG, framework migration, or crawler-only prerendering as a last resort), the HTML each page must serve, and the routing, status code and hosting config that goes with it. Use when a vibe-coded or AI-generated site is not indexed, shows an empty page in view-source, has meta tags that only appear after JavaScript runs, is invisible to ChatGPT and Perplexity, or when picking a builder before starting.
firebase-cli
Safety-first Firebase CLI (firebase-tools v15) skill for full project control — deploy, Hosting (sites/channels/rollback), Cloud Functions (+secrets), Firestore (databases/indexes/backups/delete), Realtime Database, Auth import/export, Remote Config, App Distribution, App Hosting, Extensions, Data Connect, Emulator Suite & MCP server. Classifies every command by risk tier via a deterministic classifier script and gates destructive/irreversible/cost-incurring ops behind AskUserQuestion confirmation; enforces the --non-interactive/--force contract so nothing hangs and nothing is auto-confirmed. Wrong-project preflight prevents deploying to prod by accident. Ships a 3-level self-test (static classifier battery, live read-only, guarded live-write w/ cleanup). Use when running, planning, or debugging any `firebase` command.
audit
Security and performance audit of the AGIS dashboard into docs/AGIS-AUDIT.md.
durable
Use when user data must not be lost or corrupted — creating the first database/table/schema, writing migrations, backfilling or importing data, any destructive operation (delete, drop, truncate, overwrite), setting up backups or recovery, or moving data between systems; and for "is my data safe", "will I lose my data", "back up my app" checks on existing projects. Any store — SQL (Postgres, MySQL, SQLite), document (Mongo, Firestore), serverless (Supabase, Neon, Turso), files, queues. Do NOT use for query speed or connection-pool sizing (that is lean), access control over data (that is bulletproof), or privacy/legal deletion regimes (that is compliance-guard).
mcp-tools
MCP tool decision tree and MCP-first fallback strategy. TRIGGER when: choosing whether to use an MCP tool versus a built-in, or an MCP tool is available for a task. SKIP: semantic-memory MCP usage specifically (use semantic-memory-mcp).
doctor
Check runtimes, GIS libraries, DB clients, installed modules, secrets hygiene, repo standards and toolkit version; print pass/fail with fixes.
auth
Authentication and authorization. JWT, OAuth2, OIDC, SAML, API keys, mTLS, MFA, passwordless, social login, session management, identity providers (Auth0, Okta, Cognito).
angular
Build Angular apps with the Angular CLI: standalone components, signals, zoneless, Vitest, angular-eslint, mise tasks. Use for Angular apps, routing, forms, SSR.
astro
Build content-driven websites and web apps with Astro: islands, Tailwind CSS v4, Content Layer, Vitest, Prettier, and mise tasks. Use for Astro sites, SSG, SSR, or islands.
firebase
Set up and ship Firebase backends with the Firebase CLI: emulators, Firestore rules, Auth, Functions, Hosting or App Hosting. Use when an app needs Firebase.
genkit
Build Genkit AI flows, tools, prompts, and RAG in TypeScript, Go, or Python with the Genkit CLI and dev UI. Use when a project adopts Genkit instead of ADK.
add-platform
Add support for a new AI coding tool, IDE, PR-reviewer, or context-packer to VibeTags — wire a new generated output file through ServiceRegistry, Platform, the renderer registry, and (if granular) GranularRulesWriter. Use when the user says "add platform support", "support <tool>", "generate a new output file for X", "new AI platform", or names an AI coding assistant/IDE/PR-reviewer/context-packer VibeTags doesn't yet generate a file for.
kronos-agent
Financial time-series forecasting using the Kronos foundation model (MIT, NeoQuasar). Takes OHLC candles, returns predicted future candles with configurable horizon. Infrastructure skill — called by trader agents or scheduled ingestion, not directly invoked by users or the model.
migration-planner
Plan and track cross-platform or cross-service migrations (Supabase to Firebase, single to multi-tenant, schema migrations, etc). Generates rollback-safe migration plans with state tracking.
product-health-agent
Managed agent that analyzes production app engagement and operational health. Reads Firestore aggregates, Cloud Logging, and Cloud Monitoring; mounts source repos read-only; writes structured insights to a workspace Firestore collection. Designed for daily digests and on-demand deep dives on the Glam and SpinDineSwift production apps. Read-only by design.
security-audit
Use when the user asks for a security review, security audit, vulnerability scan, secret scan, dependency or CVE check, OWASP review, pentest review, compliance evidence, or asks "is this safe to ship". Runs real scanners (Semgrep, gitleaks, TruffleHog, Trivy, osv-scanner) over code, full git history, dependencies, IaC, and Supabase/Firebase row-level security, verifies each finding against source, and writes one severity-ranked report.
seatbelt
Pre-ship safety for vibe-coded apps. Stops the agent from putting secrets in client code or git, shipping database tables without row-level security, leaving API routes without auth, opening CORS to everyone, or exposing admin keys in the browser. Use whenever writing app code that touches secrets, databases, auth, payments, or deployment, and when the user says ship, deploy, launch, publish, go live, is this safe, or /seatbelt.
create-auth-skill
Scaffold and implement authentication in TypeScript/JavaScript apps using Better Auth. Detect frameworks, configure database adapters, set up route handlers, add OAuth providers, and create auth UI pages. Use when users want to add login, sign-up, or authentication to a new or existing project with Better Auth.
pm-tracking-spec-writer
埋点与指标设计方案生成器。从产品需求/核心链路出发，输出完整的埋点方案文档（事件、字段、触发时机、口径说明、QA 校验清单）。 触发条件：用户提到"埋点"、"tracking"、"事件设计"、"数据采集"、"上报方案"、"埋点方案"、"事件规范"、"字段设计"、"指标口径"、"数据验收"、"QA校验"等关键词。 也适用于：用户提供产品PRD/需求文档要求产出埋点方案；用户提供核心用户链路要求拆解事件；用户要求规范化事件命名或字段定义；用户要求设计数据验收方案。 典型输入：事件命名规范 + 字段字典 + 核心链路描述/流程图。 不适用于：纯数据分析（用 pm-analytics）、纯BI看板搭建、纯SQL查询编写。
monorepo-sync-types
Regenerate backend types and re-export them via packages/shared/types/ in a turborepo monorepo so both apps/web/ and apps/mobile/ consume a single typed surface. Supports Supabase (via supabase gen types typescript), neon-drizzle (via drizzle-kit introspect/pull + InferSelectModel/InferInsertModel re-exports — the default DB stack), tRPC (via inference from the server router import), and custom REST (via a manual or zod-derived schema). Reads .workflow/meta.json with stack.framework="monorepo" and stack.{auth,db} populated. Use when "rigenera i tipi da Supabase", "sync DB schema to packages/shared/types", "il backend è cambiato, aggiorna i tipi", "sync types from tRPC", "sync Drizzle types after a schema change". Not for: creating shared packages from scratch (use monorepo-add-shared-package), wiring the backend client itself (use module-add or rn-module-add).
rn-backend
Use to connect an Expo + RN app to a backend (auth, database, storage, realtime), agnostic of the provider. Teaches the shared patterns: secure-store for tokens, auth state via Zustand + TanStack Query, refresh-on-401 middleware, auth-gate routing via Expo Router (app)/_layout.tsx, row-level security vs API-auth concepts. Provider-specific details live in sub-references: Supabase (default, matches the course), Firebase, custom REST/JSON, tRPC. Triggers on: "setup backend", "setup auth with X", "connect Supabase/Firebase/my API", "secure token storage", "refresh token flow", "row level security". Not for: building the login UI (rn-add-screen — uses Form template), push notifications (rn-push-notifications), payments (rn-publishing-payments).
rn-module-add
Use to wire a backend/infra module (auth, db, storage, realtime, push, payments) into a scaffolded Expo + RN app. Reads .workflow/meta.json with stack.framework="expo-rn" and the user-chosen provider for each module (Supabase, Firebase, custom REST, tRPC, RevenueCat). Installs deps, generates the wiring code (lib/auth.ts, lib/supabase.ts, etc.), updates meta.json#stack to record the choice. Always idempotent. Triggers on: "add auth", "wire up db", "set up Supabase", "set up Firebase", "add payments", "add push" (the server-side part), "aggiungi modulo X". Not for: building UI for the module (rn-add-screen does the login screen, etc.), client-side knowledge only (rn-backend, rn-push-notifications), scaffolding (rn-bootstrap).
rn-push-notifications
Use when adding push or local notifications to an Expo + RN app: requesting permissions at the right moment, registering for push (Expo push service in dev, APNs/FCM direct in prod), handling foreground + tapped + cold-start notifications, deep linking from a notification payload to a specific route, scheduling local notifications, badge management. Triggers on: "add push notifications", "local notification", "deep link from notification", "iOS/Android push setup", "register for notifications". Not for: backend setup that sends the notifications (rn-backend), animations on a notification badge (rn-animations-gestures).
setup-connectors
Guided co-pilot to set up, health-check ("doctor"), add, or extend the connectors/credentials for the CURRENT project (Firebase, Linear, Stripe, Twilio, AWS, pal, …). Does everything it can automatically, then hands Simon numbered steps for the rest and waits. Use when connectors aren't working ("can't access Firebase/Stripe/Linear", "not enough permissions"), when first setting up a machine/project, when adding a new connector, to enable a one-off prod write, or to audit the existing setup for insecure credential handling (world-readable key files, a secret inside a repo, a CLI profile defaulting to the wrong work/personal account) and fix it. Reads the per-project manifest in ~/.claude/connectors/<project>.json; the deep spec is references/connectors-setup.md.
ship-pr
Simon's PR-authoring standard — every PR body STARTS with a human-readable Deploy TLDR (imperative, do-only numbered steps covering cross-repo order, build prerequisites, deploy commands, and the post-deploy smoke). Apply whenever creating a PR or finalizing one for review, in any repo.
dart
Flutter & Dart development — the always-on coding baseline plus deep references for state management, architecture, navigation, UI/theming/animation, performance, data & networking, Firebase, media, monetization, native interop, and build tooling. Auto-applies when editing any Dart file. Use when writing or reviewing any Flutter/Dart code; read the reference matching your task.
datastore-stack-menu
Return the datastore templates this plugin offers, as a vwf menu payload. Invoked by /vwf:architecture and /vwf:setup when `datastore` is listed in the config's `stacks:` — not a general-purpose skill.
gcp-iam
Least-privilege identity on Google Cloud — the service-account shape per workload, why keyless beats JSON keys, the roles that are quietly over-broad, and how Firebase security rules relate to IAM. Use when wiring service auth, granting access, or reviewing a design for privilege.
gcp-local-stack
Which Google Cloud services can run locally, which cannot, and what to do about the ones that cannot — the emulator map behind vwf's `local_stack` harness capability. Use when setting up local development or E2E tests against a GCP-backed product, or when deciding whether a stack needs Docker.
gcp-stack-menu
Return the Google Cloud stack templates this plugin offers, as a vwf menu payload. Invoked by /vwf:architecture and /vwf:setup when `gcp` is listed in the config's `stacks:` — not a general-purpose skill.
gcp-stack-template
Return one Google Cloud stack template as a vwf template payload — its axis fields, per-capability harness mechanisms, and conventions. Invoked by /vwf:architecture and /vwf:setup after the user picks from the gcp menu — not a general-purpose skill.
identity-stack-menu
Return the identity templates this plugin offers, as a vwf menu payload. Invoked by /vwf:architecture and /vwf:setup when `identity` is listed in the config's `stacks:` — not a general-purpose skill.
apple-three-piece-analytics
Choose analytics and metrics sources for a solo / small-team Apple app and decide whether a third-party tracking SDK is justified. Use when picking an analytics SDK; when asked "should I add Firebase / Mixpanel / Amplitude / TelemetryDeck"; when asked what App Store Connect Analytics, MetricKit (`MXMetricPayload`) or Game Center can measure without an SDK; when the analytics choice drives `PrivacyInfo.xcprivacy` or forces ATT. Does NOT own MetricKit perf wiring (ios-performance-engineering), App Review privacy-label parity (app-store-review-rejections), or sink code (telemetry-facade-pattern).
build-time-secret-injection
Use when wiring a value that ships in the binary but must stay out of public-repo diffs until launch (AdMob `GADApplicationIdentifier` / banner unit ID, a third-party SDK app key) into an Apple build via xcconfig, Info.plist `$()` substitution and a guarded `Bundle.main` read, including `ci_post_clone.sh` generation on Xcode Cloud; or when CLI tooling reads an ASC `.p8` / key ID from `secrets/.env`. Not for signing certs, CloudKit or APNs keys, nor leak prevention (gitleaks, lefthook, Secret Scanning) — see apple-public-repo-security. SDK isolation is monetization-sdk-integration.
monetization-sdk-integration
Use when adding, upgrading, or auditing a third-party monetization SDK (AdMob / Google Mobile Ads incl. UMP consent; the same contract applies to any other ad or subscription SDK), or when a PR adds `import GoogleMobileAds` outside the single live-bridge file, breaks `canImport` / `.when(platforms: [.iOS])` gating, or lands without a Fake bridge. Owns the break-glass admission test, single-import-site isolation contract, and test seam. Does not cover native StoreKit 2 IAP (storekit2-iap-defaults), production ID storage (build-time-secret-injection), or App Review consequences (app-store-review-rejections).
aws-plan
AWS architecture, IaC skeleton, migration steps and cost estimate into docs/AWS-PLAN.md.
cadastral-schema
Mauza/Parcel Firestore model, size limits, geohash, geometry storage, rule constraints.
secrets-audit
Find credentials in the working tree and git history (keys, tokens, connection strings); walk through rotation and history purge.
add-mcp
Add optional MCP servers after initial install. Triggers: add mcp, mcp ekle, firebase ekle, flutter ekle, unity ekle.
agent-refine
Agent sistemini proje bazli refine et — eksik agent tespit, genis olanları böl, yeni agent tanimla, registry guncelle. Triggers: agent-refine, agent refine, agent ekle, agent bol, agent eksik.
audit
Proje kodu taraması — güvenlik, maliyet, performans, gereksiz dosya, API tehlikeleri. Genel veya odaklı.
database
Database design, SQL, NoSQL, and data management
super-claudiosoftware-development
Software development skill. Use when the user wants to build, code, automate, or deploy anything technical. Covers backend APIs, databases, workflow automation, scripts, free public APIs, and hosting/deployment. Trigger on backend: "build an API", "REST API", "database schema", "Supabase", "Firebase", "PostgreSQL", "MongoDB", "FastAPI", "Express", "Fastify", "GraphQL", "Node.js server", "Python API", "Prisma", "ORM", "authentication backend", "serverless functions". Trigger on automation: "automate this", "connect these apps", "n8n", "Make.com", "Zapier", "when X happens do Y", "no-code automation", "schedule a script", "webhook", "automate posting", "IFTTT", "auto-post to Instagram", "batch processing", "automate email". Trigger on free APIs: "free API for X", "public API", "build a weather app", "NASA API", "real-time data", "open data", "free data source", "API without credit card", "government API". Trigger on deployment: "deploy my app", "Docker", "Railway", "GitHub Actions", "CI/CD", "hosting", "go live
bot-config
管理 CloseCrab bot 配置（Firestore）。添加新 bot、给已有 bot 添加 channel、切换 channel、查看配置。当用户说"添加一个 bot"、"新建 bot"、"加个飞书 channel"、"加个 discord channel"、"切换到飞书"、"bot 配置"、"add bot"、"add channel"等关键词时触发。
deploy-profiles
How each service runs locally and in the cloud (Firebase App Hosting, Vercel, Hugging Face Spaces, EAS, Docker, AWS) with commands, config, env sources, health checks, rollback. Apply to deploy, hosting, environment or AWS tasks.
mobile-engineer-role
Operate as a mobile engineer who plans around release trains, a real device matrix, and app-store rules that a web engineer never faces. Use when building or reviewing an iOS or Android feature and you need mobile-specific release and compatibility discipline.
mobile-android-assessment
Assess an Android app (static + dynamic). Load when the target is an APK/AAB, a mobile bug-bounty scope, or "test the android app". Signals: .apk file, Java/Kotlin/Smali, AndroidManifest.xml, exported components, WebViews, hardcoded secrets, Frida/objection.
api-baas-firebase
Firebase backend-as-a-service — Firestore, Authentication, Cloud Functions v2, Storage, Hosting, Admin SDK, security rules, emulator suite
cloud-architecture-gcp
GCP service-level architecture knowledge — compute (Cloud Run/GKE/Cloud Functions/GCE), data (Cloud SQL/Spanner/Firestore/Bigtable), messaging (Pub/Sub/Cloud Tasks/Workflows), analytics (BigQuery), edge (Cloud CDN/Load Balancing/API Gateway), storage + secrets (GCS/Secret Manager/Artifact Registry), and Vertex AI. Cost models, quotas, failure modes, and cold-start gotchas. Activate when the active cloud is GCP and the work involves designing, scaling, costing, or diagnosing GCP architecture (Cloud Run cold starts, Cloud SQL connection limits, Spanner hot spots, egress, Pub/Sub backlog).
google-play-growth
Understand Google Play growth and Google Ads app acquisition. Use when evaluating Android app growth strategy, Google Ads App campaigns, Google Play store listing optimization, store listing experiments, custom store listings, web-to-app flows, Android app-growth cost planning such as CPI, CPA, tCPA, tROAS, and the measurement realities around Google Ads, GAID, Firebase, and modern attribution.
audit
Security and performance audit of the AGIS dashboard into docs/AGIS-AUDIT.md.
hn-digest
Scan the Hacker News front page and report today's themes, hot discussions, and industry mix. One request gets the whole page; output is three sections: overview, hot discussions, industry mix. Use when asked to scan HN, get today's HN front page, see what's trending on Hacker News, or produce an HN digest. Triggers: "what's on HN today", "top HN today", "HN digest", "scan HN", "hacker news trends", "what's trending on Hacker News". Trigger phrases in any language count — match on meaning, not on these exact English strings. Does not read comment text — mining a specific thread's comments is a different job and not this skill.
translate-article
Translate MDX articles between English and Japanese for global engineers. Use when the user says "translate this article", "convert to Japanese/English", or asks to localize content in `src/content/docs/`. Auto-detects source language and outputs to the correct i18n path.
slopsec
Security audit and hardening for vibe-coded SaaS apps. Use when reviewing, securing, hardening, or pen-testing an app — especially AI-generated / vibe-coded / "shipped fast" projects (Next.js, Supabase, Firebase, Express, serverless). Triggers: "is my app secure", "security review", "harden this", "check for vulnerabilities", "I'm about to launch", "audit before deploy", "exposed secrets", "leaked API keys", "before I ship". Walks the 50 most common ways vibe-coded apps get owned and produces a prioritized fix list.
firebase-cloud-functions
Complete Cloud Functions for Firebase skill — 2nd gen (Cloud Run) mandatory, idempotency, infinite loop prevention, scaling, secrets, and deployment. Use when writing or reviewing any Cloud Function.
flutter-authentication
Implement, repair, or review Flutter user authentication and session lifecycle, including OAuth or OIDC redirects, PKCE, token refresh, logout, account switching, passkeys, and device re-authentication. Use when sign-in identity or session behavior is the task; route broad threat audits to flutter-security and request transport to flutter-networking.
flutter-notifications
Implement or repair Flutter local notifications and remote push delivery across permission, scheduling, token, lifecycle, payload, interaction, and reconciliation flows. Use for notification behavior; route ordinary API transport, navigation, persistence, and custom native bridge work to their specialists.
engineering-excellence
Audits code for KISS, YAGNI, DRY, SOLID, and testability; maintains living engineering notes under .heyeddi/docs/engineering/. Use when refactoring, before merge, or when the user asks for simple scalable design, architecture notes, reuse catalog, or engineering ADRs — not for visual UX (use ux-flow-auditor) or CI gates (use pre-merge-gate).
flutter-engineering
Ensures HeyEddi Flutter projects have the right engineering stack — Flutter (Riverpod, go_router, Material 3), FastAPI backend, or Firebase tooling. Audits gaps, scaffolds as needed, runs flutter test/analyze, documents local dev servers. Use when frontend is Flutter or before design/feature work on a HeyEddi mobile/web app.
heyeddi-design
End-to-end UI design for HeyEddi stack (PrimeVue, DESIGN.md, semantic tokens: OpenProps on scaffold default). Use when the user wants to design, explore, critique, or improve existing frontend: e.g. "enterprise view", "critique the login page", "this UI looks bad", "settings page". Runs discovery, critique, polish, craft, document. Sub-commands init, discover, shape, craft, critique, polish, document. Not for pre-made screenshot handoff: use heyeddi-handoff instead.
heyeddi-handoff
Implements screens from designer screenshots and handoff notes. Two-pass workflow — designer writes mockup-brief with Implementation spec, implementer builds shell then route, verify_handoff checks tokens and layout. Use when approved mockups exist — not for greenfield design.
heyeddi-intake
Translates vague user prompts into HeyEddi product docs (personas, route intent, voice), route-specific handoff artifacts (wireframes, user mockups, or briefs), and skill-routing under .heyeddi/. Use first on new projects before @heyeddi-design, @heyeddi-handoff, or @flutter-engineering. Never hand-write product.md: use write_product.
heyeddi-orchestrator
Discover HeyEddi skills, auto-sync .heyeddi/ (skills index), cross-pillar opinions, and suggest @skills. Use at session start, after reinstalling skills, or when connecting heyeddi-product, ux-flow-auditor, and heyeddi-design on a route.
Showing top 100 of 291 skills using Firebase by quality score.
See all 291 skills via search →Integration detected automatically from skill content. Some results may be false positives.