gpc-release-flow

Pass

Audited by Gen Agent Trust Hub on May 6, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill's primary function is to orchestrate the gpc command-line interface. It provides instructions for the agent to execute commands for uploading Android App Bundles (AAB), managing tracks, and controlling staged rollouts.\n- [EXTERNAL_DOWNLOADS]: Reference documentation (references/pre-release-pipeline.md) demonstrates how to install the necessary CLI tool using npm install -g @gpc-cli/cli. The tool is a vendor-provided resource for the author 'yasserstudio'.\n- [CREDENTIALS_UNSAFE]: The skill manages sensitive credentials including Google Play Service Account JSON and various LLM API keys. It adheres to security best practices by recommending these be stored in environment variables (e.g., GPC_SERVICE_ACCOUNT, ANTHROPIC_API_KEY) rather than hardcoded in scripts or prompts.\n- [SAFE]: The skill includes a detect_gpc.mjs script that performs environment checks using hardcoded commands without external input. It also features a gpc preflight command designed to scan app bundles for security issues (like leaked secrets) before they are uploaded to the Play Store.
Audit Metadata
Risk Level
SAFE
Analyzed
May 6, 2026, 03:57 AM