The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local system commands to manage the release process, including git for branch synchronization, security for retrieving credentials from the system Keychain, and specialized tools like fastlane and jarsigner for build delivery and signature verification. These commands are integral to the stated purpose of the skill.
[EXTERNAL_DOWNLOADS]: The play-preflight.py script performs network operations to exchange Google service account assertions for access tokens. These requests target official Google API endpoints (androidpublisher.googleapis.com) and are used solely to verify publishing permissions.
[INDIRECT_PROMPT_INJECTION]: The skill reads external data from the local development environment, such as the AndroidManifest.xml and localized changelog text files, to verify version codes and release notes. While this involves processing untrusted data, the skill uses these inputs as structured data for API parameters rather than executing them as agent instructions.
[CREDENTIALS_UNSAFE]: The skill manages sensitive Google Play service account keys. It provides clear guidance for the secure handling of these secrets by instructing users to store them in the macOS Keychain using the security utility and retrieves them programmatically, which is a significant improvement over plaintext file storage.

suede-play-release