play-launchpad
Pass
Audited by Gen Agent Trust Hub on Aug 22, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill instructions specify that the provided Google Cloud Service Account JSON must be granted the Owner role on the project. This is a high-privilege role that allows complete control over the Cloud project, including the ability to manage permissions and delete resources. While the skill justifies this for automating API enablement and IAM bindings, users should be aware of the security implications of providing such broad access.
- [EXTERNAL_DOWNLOADS]: The skill setup process involves fetching resources from the author's repository via
npx skills add voys-apps/app-publishing. These are vendor-provided resources used to scaffold the local publishing toolkit. - [COMMAND_EXECUTION]: The skill makes extensive use of local command execution, including
pnpmfor build and upload tasks. It also provides a Python script within the documentation for the agent to execute, which usessubprocess.run(["open", url])to interact with the host system's web browser for Reddit recruitment posts. - [SAFE]: The skill includes several internal safety constraints, such as explicit warnings against touching specific testing tracks (e.g.,
receezy*), preventing the automatic creation of new tracks without confirmation, and requiring user approval before any production-level mutations or social media posts.
Audit Metadata