gpd-release-flow

Pass

Audited by Gen Agent Trust Hub on Sep 26, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill provides standard documentation and command sequences for managing Google Play releases using a CLI tool. All operations are within the expected scope of app publishing. It references a service account key (GPD_SERVICE_ACCOUNT_KEY) as a precondition, which is standard practice for secure API authentication.
  • [INDIRECT_PROMPT_INJECTION]: The skill demonstrates capturing an ID from one command's output to use in subsequent steps. While this is a data ingestion point, it is a routine programmatic flow for release management tools.
  • Ingestion points: SKILL.md captures output from gpd publish edit create using jq.
  • Boundary markers: None.
  • Capability inventory: Executes gpd CLI commands for file upload and API interaction.
  • Sanitization: None.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 26, 2026, 09:00 AM