gpc-app-recovery

Warn

Audited by Socket on Sep 17, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

SUSPICIOUS. The workflow matches a legitimate Google Play recovery use case and is scoped to that purpose, but it relies on an unofficial third-party `gpc` binary with ambiguous provenance and documented pipe-to-shell install patterns. The skill also enables consequential Play Console actions, though it includes an explicit user-approval guard for deploy/cancel.

Confidence: 88%Severity: 74%
Audit Metadata
Analyzed At
Sep 17, 2026, 02:33 PM
Package URL
pkg:socket/skills-sh/androidpoet%2Fplayconsole-cli-skills%2Fgpc-app-recovery%2F@5952d64045466993d718aa1017a360a6c0e523341a9c4a144b6a21589b9bb8d5