gpc-release-flow
Pass
Audited by Gen Agent Trust Hub on May 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill's primary function is to orchestrate the
gpccommand-line interface. It provides instructions for the agent to execute commands for uploading Android App Bundles (AAB), managing tracks, and controlling staged rollouts.\n- [EXTERNAL_DOWNLOADS]: Reference documentation (references/pre-release-pipeline.md) demonstrates how to install the necessary CLI tool usingnpm install -g @gpc-cli/cli. The tool is a vendor-provided resource for the author 'yasserstudio'.\n- [CREDENTIALS_UNSAFE]: The skill manages sensitive credentials including Google Play Service Account JSON and various LLM API keys. It adheres to security best practices by recommending these be stored in environment variables (e.g.,GPC_SERVICE_ACCOUNT,ANTHROPIC_API_KEY) rather than hardcoded in scripts or prompts.\n- [SAFE]: The skill includes adetect_gpc.mjsscript that performs environment checks using hardcoded commands without external input. It also features agpc preflightcommand designed to scan app bundles for security issues (like leaked secrets) before they are uploaded to the Play Store.
Audit Metadata