solana-mobile-publishing
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the official @solana-mobile/dapp-store-cli package and utilizes standard build environments such as Expo Application Services (EAS). These resources are provided by the authoring organization or well-known cloud services.
- [COMMAND_EXECUTION]: The instructions guide the agent through necessary build and publication commands, including gradlew and the dapp-store CLI tools. These are standard operations for Android development and app submission.
- [CREDENTIALS_UNSAFE]: The skill manages the lifecycle of Solana publisher keypairs and API keys. It proactively advises on secure practices, such as using the --silent flag to prevent private key data from appearing in logs and utilizing stdin to avoid leaking API keys in shell history.
- [INDIRECT_PROMPT_INJECTION]: The skill handles project files and release metadata. Ingestion points include the application package and whats-new text. The capability inventory includes file-system writes and network submission. Risks are addressed by instructing the agent to audit environment files and perform signature verification with apksigner to ensure binary integrity.
Audit Metadata