android-cicd
Warn
Audited by Gen Agent Trust Hub on Jul 8, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to execute
npx android-cicd, which downloads a package from the NPM registry. The package and its author are not recognized as trusted sources or well-known services. - [REMOTE_CODE_EXECUTION]: Running
npx android-cicdexecutes third-party code on the local environment. This package is responsible for significant tasks including keystore generation and GitHub Secrets configuration, giving it potential access to sensitive project data. - [CREDENTIALS_UNSAFE]: The setup wizard explicitly handles high-value credentials, including the
KEYSTORE_FILE(base64-encoded upload keystore),KEYSTORE_PASSWORD, and theGOOGLE_PLAY_SERVICE_ACCOUNT_JSON. Entrusting these secrets to an unverified third-party NPM package introduces a risk of credential exposure or exfiltration.
Audit Metadata