chore(deps): update firebase/agent-skills digest to 30bcb30 (#559)

* chore(deps): update firebase/agent-skills digest to 30bcb30

* security(firebase-skills): allowlist FP findings on genkit-dart and app-hosting

- developing-genkit-dart: ATR_MCP_MALICIOUS_RESPONSE matches the official
  Google Genkit installer (curl -sL cli.genkit.dev | bash), already
  allowlisted under PIPELINE_TAINT_FLOW.
- firebase-app-hosting-basics: ATR_HIGH_RISK_TOOL_GATE matches 'delete'/'Delete'
  in references/cli_commands.md documenting official Firebase CLI subcommands.

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Juan Antonio Osorio <ozz@stacklok.com>

Author: renovate[bot]

skills/developing-genkit-dart/spec.yaml

@@ -9,7 +9,7 @@ metadata:
 
 spec:
   repository: "https://github.com/firebase/agent-skills"
-  ref: "11c41e547860b33b42059ed6f7d6fddf2a5ced4b"  # main as of 2026-04-15
+  ref: "30bcb303e56f5d39f2d3c4214b53821adfb5b65c"  # main as of 2026-04-15
   path: "skills/developing-genkit-dart"
   version: "0.1.0"
 
@@ -23,3 +23,11 @@ security:
       reason: "firebase/agent-skills is licensed Apache-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter."
     - rule_id: PIPELINE_TAINT_FLOW
       reason: "The skill's prerequisites cite the official Genkit CLI installer `curl -sL cli.genkit.dev | bash` as a documented install command."
+    - rule_id: ATR_MCP_MALICIOUS_RESPONSE
+      reason: |
+        Same root cause as PIPELINE_TAINT_FLOW above - matches the official
+        Genkit CLI installer pattern `curl -sL cli.genkit.dev | bash` cited as
+        a documented prerequisite (SKILL.md:17). This is hard-coded skill
+        instruction text, not an MCP tool response. The host (cli.genkit.dev)
+        is the official Google Genkit installer endpoint. Verified at digest
+        30bcb303e56f5d39f2d3c4214b53821adfb5b65c.

skills/developing-genkit-go/spec.yaml

@@ -9,7 +9,7 @@ metadata:
 
 spec:
   repository: "https://github.com/firebase/agent-skills"
-  ref: "11c41e547860b33b42059ed6f7d6fddf2a5ced4b"
+  ref: "30bcb303e56f5d39f2d3c4214b53821adfb5b65c"
   path: "skills/developing-genkit-go"
   version: "0.1.0"
 

skills/developing-genkit-js/spec.yaml

@@ -9,7 +9,7 @@ metadata:
 
 spec:
   repository: "https://github.com/firebase/agent-skills"
-  ref: "11c41e547860b33b42059ed6f7d6fddf2a5ced4b"
+  ref: "30bcb303e56f5d39f2d3c4214b53821adfb5b65c"
   path: "skills/developing-genkit-js"
   version: "0.1.0"
 

skills/firebase-ai-logic-basics/spec.yaml

@@ -9,7 +9,7 @@ metadata:
 
 spec:
   repository: "https://github.com/firebase/agent-skills"
-  ref: "11c41e547860b33b42059ed6f7d6fddf2a5ced4b"
+  ref: "30bcb303e56f5d39f2d3c4214b53821adfb5b65c"
   path: "skills/firebase-ai-logic-basics"
   version: "0.1.0"
 

skills/firebase-app-hosting-basics/spec.yaml

@@ -9,7 +9,7 @@ metadata:
 
 spec:
   repository: "https://github.com/firebase/agent-skills"
-  ref: "11c41e547860b33b42059ed6f7d6fddf2a5ced4b"
+  ref: "30bcb303e56f5d39f2d3c4214b53821adfb5b65c"
   path: "skills/firebase-app-hosting-basics"
   version: "0.1.0"
 
@@ -21,3 +21,12 @@ security:
   allowed_issues:
     - rule_id: MANIFEST_MISSING_LICENSE
       reason: "firebase/agent-skills is licensed Apache-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter."
+    - rule_id: ATR_HIGH_RISK_TOOL_GATE
+      reason: |
+        False positive - matches on `delete` / `Delete` in
+        references/cli_commands.md, where the skill documents the official
+        Firebase App Hosting CLI commands (e.g.,
+        `firebase apphosting:backends:delete`,
+        `firebase apphosting:rollouts:delete`). These are documented Firebase
+        CLI subcommands a user explicitly invokes, not autonomous high-risk
+        tool calls. Verified at digest 30bcb303e56f5d39f2d3c4214b53821adfb5b65c.

skills/firebase-auth-basics/spec.yaml

@@ -9,7 +9,7 @@ metadata:
 
 spec:
   repository: "https://github.com/firebase/agent-skills"
-  ref: "11c41e547860b33b42059ed6f7d6fddf2a5ced4b"
+  ref: "30bcb303e56f5d39f2d3c4214b53821adfb5b65c"
   path: "skills/firebase-auth-basics"
   version: "0.1.0"
 

skills/firebase-basics/spec.yaml

@@ -9,7 +9,7 @@ metadata:
 
 spec:
   repository: "https://github.com/firebase/agent-skills"
-  ref: "11c41e547860b33b42059ed6f7d6fddf2a5ced4b"
+  ref: "30bcb303e56f5d39f2d3c4214b53821adfb5b65c"
   path: "skills/firebase-basics"
   version: "0.1.0"
 

skills/firebase-data-connect-basics/spec.yaml

@@ -9,7 +9,7 @@ metadata:
 
 spec:
   repository: "https://github.com/firebase/agent-skills"
-  ref: "11c41e547860b33b42059ed6f7d6fddf2a5ced4b"
+  ref: "30bcb303e56f5d39f2d3c4214b53821adfb5b65c"
   path: "skills/firebase-data-connect-basics"
   version: "0.1.0"
 

skills/firebase-firestore-enterprise-native-mode/spec.yaml

@@ -9,7 +9,7 @@ metadata:
 
 spec:
   repository: "https://github.com/firebase/agent-skills"
-  ref: "11c41e547860b33b42059ed6f7d6fddf2a5ced4b"
+  ref: "30bcb303e56f5d39f2d3c4214b53821adfb5b65c"
   path: "skills/firebase-firestore-enterprise-native-mode"
   version: "0.1.0"
 

skills/firebase-firestore-standard/spec.yaml

@@ -9,7 +9,7 @@ metadata:
 
 spec:
   repository: "https://github.com/firebase/agent-skills"
-  ref: "11c41e547860b33b42059ed6f7d6fddf2a5ced4b"
+  ref: "30bcb303e56f5d39f2d3c4214b53821adfb5b65c"
   path: "skills/firebase-firestore-standard"
   version: "0.1.0"