gpc-setup
Pass
Audited by Gen Agent Trust Hub on May 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides an option to download an installation script (install.sh) from the author's repository (yasserstudio/gpc) on GitHub. It also uses npx to fetch the CLI package if not locally present.\n- [REMOTE_CODE_EXECUTION]: One of the documented installation procedures involves downloading and executing a remote shell script via curl | bash. This is a vendor-provided installation method for a standalone binary.\n- [COMMAND_EXECUTION]: The detection script (scripts/detect_gpc.mjs) uses execSync to invoke the gpc command and check for authentication status and version information.\n- [SAFE]: The documentation includes security best practices for managing Google Play service account keys, such as utilizing environment variables in CI and redacting sensitive values from terminal history or diagnostic outputs.
Audit Metadata