gpc-ci-integration

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). An operational dependency on an external script fetched via curl is used during setup or runtime, but the source domain (raw.githubusercontent.com) lacks strong first-party enterprise ownership or verifiable authentication, categorizing it as a weak operational dependency.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill integrates Google Play Console CLI (GPC) into CI/CD pipelines to automate app publishing, track management, vitals monitoring, and release notes generation. It mentions maintenance commands like refunding orders or revoking subscriptions which move money, but these require explicit CLI arguments (--yes) and service-level API credentials. Overall, the primary purpose is CI/CD deployment automation (indirect/service management), and financial execution/refund routes are protected by explicit command-line flags and authenticated Google Play service account credentials. Therefore, it qualifies for the medium tier as an indirect/operational workflow with credential gating.