chore(deps): update firebase/agent-skills digest to d81cd20

[renovate]

This PR contains the following updates:

Package	Update	Change
firebase/agent-skills	digest	fafde8b → d81cd20

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

🛡️ Skill Security Scan Results

✅ developing-genkit-dart

• Status: Passed
• Findings: 5
• Allowed (not blocking): 2
  • MANIFEST_MISSING_LICENSE (Allowed: firebase/agent-skills is licensed Apache-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter.)
  • PIPELINE_TAINT_FLOW (Allowed: The skill's prerequisites cite the official Genkit CLI installer curl -sL cli.genkit.dev | bash as a documented install command.)

❌ developing-genkit-go

• Status: Failed
• Findings: 7
• Blocking: 1

Blocking issues:

• [ATR_MCP_MALICIOUS_RESPONSE] (CRITICAL) Pattern detected: curl -sL cli.genkit.dev | bash (SKILL.md:61)

Allowlisted (not blocking):

• MANIFEST_MISSING_LICENSE (Allowed: firebase/agent-skills is licensed Apache-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter.)
• PIPELINE_TAINT_FLOW (Allowed: The skill's prerequisites cite the official Genkit CLI installer curl -sL cli.genkit.dev | bash as a documented install command.)
• PIPELINE_TAINT_FLOW (Allowed: The skill's prerequisites cite the official Genkit CLI installer curl -sL cli.genkit.dev | bash as a documented install command.)

✅ developing-genkit-js

• Status: Passed
• Findings: 4
• Allowed (not blocking): 1
  • MANIFEST_MISSING_LICENSE (Allowed: firebase/agent-skills is licensed Apache-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter.)

✅ firebase-ai-logic-basics

• Status: Passed
• Findings: 6
• Allowed (not blocking): 1
  • MANIFEST_MISSING_LICENSE (Allowed: firebase/agent-skills is licensed Apache-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter.)

✅ firebase-app-hosting-basics

• Status: Passed
• Findings: 7
• Allowed (not blocking): 3
  • MANIFEST_MISSING_LICENSE (Allowed: firebase/agent-skills is licensed Apache-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter.)
  • ATR_HIGH_RISK_TOOL_GATE (Allowed: False positive - matches on delete / Delete in
    references/cli_commands.md, where the skill documents the official
    Firebase App Hosting CLI commands (e.g.,
    firebase apphosting:backends:delete,
    firebase apphosting:rollouts:delete). These are documented Firebase
    CLI subcommands a user explicitly invokes, not autonomous high-risk
    tool calls. Verified at digest 30bcb303e56f5d39f2d3c4214b53821adfb5b65c.
    )
  • ATR_HIGH_RISK_TOOL_GATE (Allowed: False positive - matches on delete / Delete in
    references/cli_commands.md, where the skill documents the official
    Firebase App Hosting CLI commands (e.g.,
    firebase apphosting:backends:delete,
    firebase apphosting:rollouts:delete). These are documented Firebase
    CLI subcommands a user explicitly invokes, not autonomous high-risk
    tool calls. Verified at digest 30bcb303e56f5d39f2d3c4214b53821adfb5b65c.
    )

✅ firebase-auth-basics

• Status: Passed
• Findings: 3

✅ firebase-basics

• Status: Passed
• Findings: 5

✅ firebase-data-connect-basics

• Status: Passed
• Findings: 2

✅ firebase-hosting-basics

• Status: Passed
• Findings: 5
• Allowed (not blocking): 1
  • MANIFEST_MISSING_LICENSE (Allowed: firebase/agent-skills is licensed Apache-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter.)

✅ firebase-security-rules-auditor

• Status: Passed
• Findings: 2
• Allowed (not blocking): 1
  • MANIFEST_MISSING_LICENSE (Allowed: firebase/agent-skills is licensed Apache-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter.)

---

Summary: Scanned 10 skill(s), found 1 blocking issue(s).

⚠️ Action Required: Review the blocking findings. Add a justified entry to the skill's security.allowed_issues[] in its spec.yaml if the finding is a false positive.