gpd-release-flow
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides standard documentation and command sequences for managing Google Play releases using a CLI tool. All operations are within the expected scope of app publishing. It references a service account key (
GPD_SERVICE_ACCOUNT_KEY) as a precondition, which is standard practice for secure API authentication. - [INDIRECT_PROMPT_INJECTION]: The skill demonstrates capturing an ID from one command's output to use in subsequent steps. While this is a data ingestion point, it is a routine programmatic flow for release management tools.
- Ingestion points:
SKILL.mdcaptures output fromgpd publish edit createusingjq. - Boundary markers: None.
- Capability inventory: Executes
gpdCLI commands for file upload and API interaction. - Sanitization: None.
Audit Metadata