القائمة
Review Firebase Security Rules and Angular application security patterns
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/jimmykane/quantified-self --skill security-reviewيبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
Analyze one or more authorized Quantified Self activities through its read-only MCP tools. Use for individual workouts, activity summaries, canonical metrics, laps, MTB jumps, swim lengths, pace or power charts, breadcrumb traces, or finding activities near a place; use the training skill for aggregate trends across many activities.
Compare the user's authorized Quantified Self data across two or more health and fitness domains through its read-only MCP tools. Use for cross-domain questions such as sleep versus training, weight versus activity, or recovery trends that require combining measurements, Training metrics, sleep, activities, or routes; use the focused Quantified Self skills for single-domain requests or multiple independent summaries that do not need comparison.
Analyze the user's authorized Quantified Self sleep data through its read-only MCP tools. Use for sleep sessions, duration, stages, efficiency, naps, bedtime or wake-time patterns, HRV, sleep heart rate, blood oxygen, respiration, and sleep-oriented recovery trends; use the cross-domain Quantified Self skill when comparing sleep with training, measurements, or activities.
استنادا إلى تصنيف SOC المهني
عرض SKILL.md
| name | security-review |
| description | Review Firebase Security Rules and Angular application security patterns |
Perform security audits focusing on Firebase Security Rules and Angular application security.
# Validate Firestore rules syntax
firebase deploy --only firestore:rules --dry-run
# Run Firestore rules tests
npm run test:rules
firestore.rulessrc/firestore.rules.spec.ts| Issue | Risk | Check |
|---|---|---|
| Missing auth check | HIGH | Every rule should check request.auth != null |
| Overly permissive writes | HIGH | Validate data shape on writes |
| Missing resource ownership | HIGH | Verify request.auth.uid == resource.data.userId |
| Read-only fields modified | MEDIUM | Use !('fieldName' in request.resource.data.diff(resource.data)) |
| Unbounded list queries | MEDIUM | Add limits to collection reads |
[ ] All collections require authentication
[ ] Users can only access their own data (uid check)
[ ] Admin operations check custom claims
[ ] Write operations validate data structure
[ ] Sensitive fields cannot be modified after creation
[ ] Delete operations are appropriately restricted
# Start emulator and run rules tests
npm run test:rules
# Or manually:
npx firebase emulators:exec --project demo-test --only firestore 'npx vitest run --config vitest.rules.config.ts'
| Pattern | Location |
|---|---|
| Route guards | src/app/authentication/ |
| Pro-only directive | src/app/directives/pro-only.directive.ts |
| Has-role directive | src/app/directives/has-role.directive.ts |
[ ] No hardcoded API keys in source code
[ ] Environment files excluded from git
[ ] Firebase App Check enabled
[ ] CORS configured correctly on Cloud Functions
[ ] User input sanitized before storage
[ ] Error messages don't leak sensitive info
When performing a security review, document findings using this format:
## Security Review: [Feature/Component]
### Scope
- Files reviewed: [list]
- Rules affected: [list]
### Findings
#### [CRITICAL/HIGH/MEDIUM/LOW] - Issue Title
- **Location**: `file:line`
- **Issue**: Description
- **Risk**: Potential impact
- **Recommendation**: How to fix