The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides standard shell commands for Android development, including keytool for certificate management, gradlew for builds, and bundletool for artifact verification. These are the standard tools provided by the Android SDK and OpenJDK.
[CREDENTIALS_SAFE]: The skill demonstrates strong security practices regarding secrets. It explicitly warns against hardcoding passwords in build files, recommends the use of environment variables and gitignored .properties files, and provides instructions for using GitHub Actions secrets. It also notes that passing passwords directly in CLI arguments can expose them in process tables and suggests file-based alternatives for tools like bundletool.
[DATA_EXPOSURE_PREVENTION]: There is a recurring emphasis on keeping the Android keystore (.jks) out of version control. The skill provides .gitignore rules and technical guidance on storing these artifacts in secure locations like ~/.android-keystores or CI environments.
[EXTERNAL_DOWNLOADS]: The skill references well-known and official resources for dependencies, such as Google's official documentation (developer.android.com) and the official GitHub repository for bundletool (google/bundletool). It also utilizes standard, well-maintained GitHub Actions from the actions/ organization.
[DYNAMIC_EXECUTION]: The Gradle configuration examples use providers.exec to retrieve the git commit count for versionCode management. This is a standard and safe practice for generating reproducible version numbers in Android builds.

android-build-sign