play-launchpad

Pass

Audited by Gen Agent Trust Hub on Aug 22, 2026

Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [CREDENTIALS_UNSAFE]: The skill instructions specify that the provided Google Cloud Service Account JSON must be granted the Owner role on the project. This is a high-privilege role that allows complete control over the Cloud project, including the ability to manage permissions and delete resources. While the skill justifies this for automating API enablement and IAM bindings, users should be aware of the security implications of providing such broad access.
  • [EXTERNAL_DOWNLOADS]: The skill setup process involves fetching resources from the author's repository via npx skills add voys-apps/app-publishing. These are vendor-provided resources used to scaffold the local publishing toolkit.
  • [COMMAND_EXECUTION]: The skill makes extensive use of local command execution, including pnpm for build and upload tasks. It also provides a Python script within the documentation for the agent to execute, which uses subprocess.run(["open", url]) to interact with the host system's web browser for Reddit recruitment posts.
  • [SAFE]: The skill includes several internal safety constraints, such as explicit warnings against touching specific testing tracks (e.g., receezy*), preventing the automatic creation of new tracks without confirmation, and requiring user approval before any production-level mutations or social media posts.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 22, 2026, 07:37 PM