play-developer-api-reference

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt includes explicit Authorization header examples (e.g., "Authorization: Bearer ya29.a0Af...") and instructs sending "Authorization: Bearer " on every request, which encourages the model to embed access tokens verbatim in generated requests/commands.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a Google Play billing/subscriptions reference and documents specific endpoints that perform monetary actions: e.g., orders.refund (POST to issue a full refund), purchases.subscriptionsv2.revoke/cancel/defer (immediately revoke, cancel, or change billing dates), purchases.products.consume/acknowledge, and catalog monetization endpoints (create/update/delete subscription and in-app product records). It also lists the required androidpublisher OAuth scope and example request shapes for refund/cancel operations. These are specific APIs to execute financial operations (refunds, subscription management, monetization changes), not generic tooling.