gpc-release-flow

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill facilitates the execution of the gpc command-line tool to manage app bundles, tracks, and rollouts on the Google Play Console. This is the primary intended function of the skill.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines workflows that ingest external text for release notes, creating a potential surface for indirect instructions to be processed by the agent or the deployment tool. 1. Ingestion points: The --release-notes parameter in the gpc bundles upload command found in SKILL.md. 2. Boundary markers: The instructions do not specify any delimiters or safety warnings for the agent when handling release note strings. 3. Capability inventory: The skill utilizes shell command execution via the gpc CLI to interact with production release environments. 4. Sanitization: There is no evidence of sanitization, validation, or escaping of the release note content before it is passed to the command line.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 02:33 PM