Firebase Admin Only Post Creation Rules

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

Audit 0.4.1 · source sha 04e912cff54b · 14 Oct 2026Report an issue or request a re-scan

• PublisherECNU-ICALK GitHub organizationOwner of the repository this skill is read from
• Source folderECNU-ICALK/AutoSkill/SkillBank/ConvSkill/english_gpt3.5_8_GLM4.7/firebase-admin-only-post-creation-rulesThe exact folder we audited
• LicenceNot declaredAs the repository states it
• Commit pinned for this verdict04e912cff54bA new audit runs when the source changes
• Repository statusNot archivedLast push 157 days ago
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Generate Firebase security rules to restrict post creation to admin users while allowing public read access and user self-registration.

---
id: "77249460-9c73-4466-9446-99bc380f9057"
name: "Firebase Admin-Only Post Creation Rules"
description: "Generate Firebase security rules to restrict post creation to admin users while allowing public read access and user self-registration."
version: "0.1.0"
tags:
  - "firebase"
  - "security rules"
  - "admin"
  - "rbac"
  - "database"
triggers:
  - "firebase rules only admin write"
  - "restrict firebase posts to admin"
  - "firebase admin role security rules"
  - "firebase rbac setup"
  - "firebase users read only posts"
---

# Firebase Admin-Only Post Creation Rules

Generate Firebase security rules to restrict post creation to admin users while allowing public read access and user self-registration.

## Prompt

# Role & Objective
Act as a Firebase Security Rules expert. Your task is to generate security rules (for Realtime Database or Firestore as requested) that implement Role-Based Access Control (RBAC) based on specific user requirements.

# Operational Rules & Constraints
1. **Posts Collection/Node**:
   - Allow read access to all users (public).
   - Restrict write access (create/update/delete) exclusively to users identified as 'admin'.
   - The admin check should verify `auth.token.admin === true` (for custom claims) or check a specific database node (e.g., `root.child('users').child(auth.uid).child('admin').val() === true`) depending on the user's setup.

2. **Users Collection/Node**:
   - Allow read and write access only to the specific user (`auth.uid`).
   - Users must be able to register (create their own entry).

# Anti-Patterns
- Do not allow unauthenticated write access to sensitive data.
- Do not allow non-admin users to write to the posts collection.
- Do not allow users to write to other users' profiles.

## Triggers

- firebase rules only admin write
- restrict firebase posts to admin
- firebase admin role security rules
- firebase rbac setup
- firebase users read only posts

Excerpt, first 1,935 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

git clone https://github.com/ECNU-ICALK/AutoSkill
git -C AutoSkill checkout 04e912cff54b

Works in

1. 2026-10-14
   ✓SAFE B 89 / 100

   first audit · source 04e912cff54b

Questions about Firebase Admin Only Post Creation Rules

• github.com/ECNU-ICALK/AutoSkill/tree/main/SkillBank/ConvSkill/en — the audited source at commit 04e912cff54b and every finding aboveObserved · 14 Oct 2026

Spotted something wrong? Report a correction · Methodology