feat(skills): add 12 Firebase skill entries (OCI distribution)

[JAORMX]

Summary

Adds the 12-skill Firebase pack from firebase/agent-skills to the ToolHive catalog. Content is Apache-2.0, pinned upstream to commit 4679fc8 and packaged by Dockyard (see stacklok/dockyard#513) to ghcr.io/stacklok/dockyard/skills/<name>:0.1.0.

Follows the OCI-distribution pattern established by PR #1093 (claude-api), PR #1094 (toolhive-cli-user), PR #1095 (trailofbits security skills), and PR #1109 (gemini).

Skills added

Firebase fundamentals

• firebase-basics — project setup, SDK install, Firebase CLI, emulators, product selection
• firebase-auth-basics — sign-in methods, session management, custom claims across platforms

AI with Firebase

• firebase-ai-logic-basics — client-side Gemini/Imagen access with App Check and per-user rate controls
• developing-genkit-dart — Genkit flows, models, tools, prompts for Dart/Flutter apps
• developing-genkit-go — Genkit flows, tool calling, retrieval, observability for Go services
• developing-genkit-js — Genkit flows, plugins, observability for Node.js and Next.js apps

Data

• firebase-data-connect-basics — Firebase SQL Connect (managed Postgres + GraphQL, typed SDKs, Auth integration)
• firebase-firestore-standard — document DB for mobile/web with offline sync, rules, indexes
• firebase-firestore-enterprise-native-mode — Firestore on GCP for backend workloads, multi-region, migrations

Hosting

• firebase-hosting-basics — static/dynamic site hosting, preview channels, GitHub Actions integration
• firebase-app-hosting-basics — full-stack Next.js/Angular deploys with rollouts and backends

Security

• firebase-security-rules-auditor — audits Firestore/RTDB/Cloud Storage rules for bypass patterns and authorization gaps

Notes for review

• License: Apache-2.0. Confirmed at the firebase/agent-skills repo root; upstream does not embed an SPDX identifier in per-skill SKILL.md frontmatter, which is tracked as an allowed Dockyard manifest issue.

• Upstream name drift (3 skills). Three skills have upstream SKILL.md name: frontmatter that differs from the dockyard metadata.name / OCI tag:

  • firebase-ai-logic-basics — upstream frontmatter name is firebase-ai-logic
  • firebase-data-connect-basics — upstream frontmatter name is firebase-data-connect
  • firebase-security-rules-auditor — upstream frontmatter name is firestore-security-rules-auditor

  The catalog name and directory match the dockyard manifest name (which is what the OCI tag uses: ghcr.io/stacklok/dockyard/skills/<name>:0.1.0). This keeps the catalog entry aligned with the OCI identifier users will actually install; flagging it here for reviewer visibility.

• No allowedTools. None of the 12 skills declare mcp__* tools — they use Claude Code built-ins and the Firebase CLI (npx -y firebase-tools@latest).

• No skill/SKILL.md subfolder. Following the claude-api / toolhive-cli-user precedent — OCI is authoritative, and a commit-pinned git package is included as a fallback.

• Icons. All 12 skills share the same monochrome stylized-flame SVG (thematic for Firebase). Happy to differentiate per-skill if reviewers prefer.

Test plan

• task catalog:validate — 32 skills total, all valid (both upstream and toolhive formats)
• task catalog:build — all 12 new skills present under data.skills in build/toolhive/registry-upstream.json
• task catalog:validate in CI
• Post-merge: skills appear in the published registry-upstream.json feed

Signed-off-by: Juan Antonio Osorio ozz@stacklok.com

[github-actions]

Registry Build Preview

All registries built successfully!

Registry: official

• Total Servers: 68
  • Container-based: 47
  • Remote: 21
• Skills: 0
• File Size: 1.5M
• Last Updated: 2026-04-21T09:30:07Z

Registry: toolhive

• Total Servers: 113
  • Container-based: 82
  • Remote: 31
• Skills: 32
• File Size: 1.9M
• Last Updated: 2026-04-21T09:30:07Z