The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides instructions to execute various shell commands for generating release keystores, building the Android App Bundle (AAB), and verifying signatures.
Evidence: Commands such as keytool -genkeypair, ./gradlew :app:bundleRelease, and jarsigner -verify are listed in the prerequisites section of SKILL.md.
[DYNAMIC_EXECUTION]: The skill utilizes JavaScript execution through a browser automation tool to interact with the Google Play Console user interface, particularly to handle elements that are difficult to interact with via standard clicks.
Evidence: The instructions explicitly use browser_evaluate() to perform clicks on buttons identified by debug-id attributes in SKILL.md.
[INDIRECT_PROMPT_INJECTION]: The workflow relies on the content of a local CHANGELOG.md file to provide the text for Play Store release notes, creating a surface for potential injection if the file is modified by an untrusted source.
Ingestion points: The agent is instructed to read the CHANGELOG.md file at the repository root as the source of truth for the Play release notes.
Boundary markers: There are no specified boundary markers or instructions for the agent to ignore potentially malicious content within the changelog text.
Capability inventory: The skill uses Playwright MCP tools like browser_type and browser_evaluate to input the changelog data into the Google Play Console.
Sanitization: No validation or sanitization steps are described for the data extracted from the CHANGELOG.md file before it is used in automation steps.

android-app-submission