The Agent Skills Directory

[SAFE]: The skill facilitates legitimate Android app deployment workflows using the GPC CLI. It follows professional security practices, such as recommending the use of CI/CD secrets for service account credentials and implementing staged rollouts to mitigate risk during production releases.
[INDIRECT_PROMPT_INJECTION]: The skill describes functionality for generating release notes from git logs using AI models (gpc changelog generate --ai). This creates a potential surface for indirect prompt injection if an attacker can influence the git commit messages processed by the tool.
Ingestion points: Git commit history and files within the release-notes/ directory are processed by the CLI tool.
Boundary markers: The skill documentation does not mention specific delimiters, though it highlights an offline prompt-generation mode (--format prompt) that allows for manual review of content before processing.
Capability inventory: The skill utilizes the gpc CLI to perform network operations against Google Play APIs and external AI providers, as well as file system operations for uploading bundles and managing metadata.
Sanitization: The skill instructions do not specify internal sanitization procedures for the log data being summarized.
[COMMAND_EXECUTION]: The environment detection script scripts/detect_gpc.mjs uses execSync to check the installation and authorization status of the gpc command. The commands executed are hardcoded strings or derived from fixed CLI paths and do not incorporate unvalidated user input.

gpc-release-flow