play-store-publish
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements robust security practices for handling sensitive credentials. It includes multiple warnings against committing service account JSON keys to version control and provides explicit instructions for using CI/CD secrets (e.g., GitHub Secrets) to manage these assets securely.
- [SAFE]: The provided automation scripts (references/upload_aab.py and references/upload_aab.sh) interact exclusively with official Google Play Developer API endpoints (googleapis.com). Data transmission is handled via secure methods: the Python script uses 'google-auth' for authorized sessions, and the Bash script uses 'gcloud' to mint short-lived bearer tokens, minimizing the exposure of long-lived credentials.
- [SAFE]: The skill uses industry-standard tools and libraries, such as 'fastlane', 'google-auth', and 'requests'. The GitHub Actions integration references official and well-known community actions (actions/checkout, actions/setup-python, r0adkll/upload-google-play) consistent with its primary purpose of mobile release automation.
- [SAFE]: Input handling in the scripts is secure. The Bash script utilizes 'jq' for JSON construction, preventing JSON injection vulnerabilities when handling user-supplied release notes or version codes.
- [SAFE]: No malicious patterns such as obfuscation, persistence mechanisms, or unauthorized privilege escalation were detected. All external references and dependencies are directed towards trusted organizations or well-known development services.
Audit Metadata