android-release-play
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates communication with official Google Play and OAuth2 endpoints (googleapis.com) to manage release edits and upload binary artifacts. These requests are well-defined and essential for the skill's primary function.
- [COMMAND_EXECUTION]: The release automation scripts execute standard development tools including git, npm, npx, and the Gradle wrapper (gradlew). These are used to verify the repository state, prebuild the application, and generate the final production bundles.
- [CREDENTIALS_UNSAFE]: The skill includes a dedicated auditing tool (check-play-release-setup.mjs) that scans the codebase, configuration files, and environment for accidentally committed signing passwords or keystore files. It provides actionable remediation guidance to ensure secrets remain in secure, git-ignored locations.
- [SAFE]: The security checkers for Android App Bundles and repository configuration are built using only Node.js core modules, ensuring that the auditing process itself does not introduce external package dependencies. All test data containing Base64-encoded artifacts are verified as legitimate compiled tool output used exclusively for regression testing.
Audit Metadata