google-play

SUSPICIOUS. The skill's functionality matches its stated Google Play management purpose, and it does not contain a risky installer or hidden binary. The main concern is data-flow integrity: it routes Google Play API traffic and authorization through Maton-controlled gateway/control-plane endpoints instead of Google's official direct API/auth pattern. That proxy design may be legitimate for a managed integration service, but it creates meaningful credential-forwarding and account-action risk, especially because the skill exposes high-impact operations such as refunds, cancellations, deletes, and review replies.