play-store-publish — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited play-store-publish (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are in AUTONOMOUS MODE. Do NOT ask questions. Do NOT pause for confirmation. Execute every phase below in sequence, making decisions based on what you find.
============================================================ PHASE 0 — INPUT ============================================================
$ARGUMENTS may contain:
signing, metadata, internal, rollout, data-safety, fastlane--first-upload — include extra guidance for first-time Play Store submissions============================================================ PHASE 1 — PROJECT ASSESSMENT ============================================================
build.gradle.kts, build.gradle, or settings.gradle.ktspubspec.yaml and android/ directoryandroid/ directoryapplicationId, versionCode, versionName from build configfastlane/ directory)*.jks, *.keystore)signingConfigsminSdk, targetSdk, and compileSdk versions============================================================ PHASE 2 — SIGNING KEY MANAGEMENT ============================================================
Upload key generation:
keytool command for creating upload keystore (RSA 2048, 10000 day validity)app/build.gradle.kts using environment variables (never hardcoded)Security:
.gitignore: *.jks, *.keystore, key.propertieskey.properties template with empty values============================================================ PHASE 3 — AAB CONFIGURATION ============================================================
Ensure Android App Bundle is properly configured:
============================================================ PHASE 4 — FASTLANE CONFIGURATION ============================================================
Generate fastlane/Fastfile with these lanes:
| Lane | Action | Trigger |
|---|---|---|
test | Run ./gradlew test | Pre-flight check |
build_release | Build signed AAB | Called by other lanes |
internal | Build + upload to internal testing track | Merge to develop |
beta | Promote internal to closed testing (beta) | Manual trigger |
release | Promote beta to production at 10% rollout | Tag on main |
increase_rollout | Increase production rollout percentage | Manual trigger |
Generate fastlane/Appfile with json_key_file and package_name references.
All signing credentials passed via environment variables, never hardcoded.
============================================================ PHASE 5 — PLAY CONSOLE SERVICE ACCOUNT ============================================================
Document the Google Play Console API setup:
Generate fastlane/.env.default template with placeholder values. Add to .gitignore: fastlane/play-store-key.json, fastlane/.env
============================================================ PHASE 6 — STORE LISTING METADATA ============================================================
Generate fastlane/metadata/android/en-US/ directory structure:
title.txt (max 30 chars) — primary keyword + brandshort_description.txt (max 80 chars) — strongest value propositionfull_description.txt (max 4000 chars) — structure: value prop, key features, social proof, CTA. First 5 lines visible before "Read more". Include relevant keywords naturally.changelogs/default.txt — release notes templateImage requirements:
phoneScreenshots/ — 2-8 phone screenshots requiredsevenInchScreenshots/ — 7" tablet screenshotstenInchScreenshots/ — 10" tablet screenshotsfeatureGraphic.png — 1024x500 requiredicon.png — 512x512 hi-res icon============================================================ PHASE 7 — DATA SAFETY FORM ============================================================
Analyze the app's actual data collection and generate a data safety response template:
| Data Type | Collected | Shared | Purpose | Optional | User Control |
|---|---|---|---|---|---|
| ? | ? | Account management | ? | Can delete | |
| Name | ? | ? | App functionality | ? | Can delete |
| Crash logs | ? | ? | Analytics | ? | Cannot opt out |
| Device ID | ? | ? | Analytics | ? | Cannot opt out |
Check for:
============================================================ PHASE 8 — CONTENT RATING ============================================================
Generate content rating questionnaire guidance based on app analysis:
Recommend the expected IARC rating based on findings.
============================================================ PHASE 9 — STAGED ROLLOUT STRATEGY ============================================================
| Stage | Rollout | Duration | Gate Criteria | Action if Issues |
|---|---|---|---|---|
| Internal | Invite only | 3-5 days | Manual testing passes | Fix and re-upload |
| Closed beta | Select users | 1-2 weeks | Crash-free > 99.5% | Fix critical issues |
| Open beta | Public opt-in | 1 week | ANR rate < 0.5% | Fix or halt |
| Production 10% | 10% | 2 days | Crash-free > 99% | Halt if < 98% |
| Production 50% | 50% | 2 days | Same metrics hold | Halt if regression |
| Production 100% | 100% | Ongoing | Ongoing monitoring | Hotfix if needed |
Document how to: pause, resume, halt, and rollback a staged rollout.
============================================================ SELF-HEALING VALIDATION (max 2 iterations) ============================================================
After completing deployment/infrastructure changes, validate:
IF STILL FAILING after 2 iterations:
============================================================ OUTPUT ============================================================
## Play Store Publishing Pipeline Complete
### Signing
- Upload Key: {generated / existing}
- Play App Signing: {enabled / not enrolled}
- Package Name: {detected applicationId}
### Fastlane Lanes
| Lane | Action | Trigger |
|------|--------|---------|
| test | Run unit tests | Pre-flight |
| internal | Build AAB + upload to internal | Merge to develop |
| beta | Promote internal to beta | Manual |
| release | Promote beta to production (10%) | Tag on main |
| increase_rollout | Increase production rollout | Manual |
### Metadata Status
| File | Status | Notes |
|------|--------|-------|
| title.txt | {READY / TEMPLATE} | max 30 chars |
| full_description.txt | {READY / TEMPLATE} | max 4000 chars |
| screenshots | {PRESENT / NEEDED} | 2-8 phone required |
| featureGraphic.png | {PRESENT / NEEDED} | 1024x500 required |
### Data Safety
| Data Type | Collected | Shared | Purpose |
|-----------|-----------|--------|---------|
| {type} | {yes/no} | {yes/no} | {purpose} |
### Files Created
{list all generated files with paths}============================================================ NEXT STEPS ============================================================
bundle exec fastlane internal to push your first internal test builddeploy/mobile-ci-cd to automate builds and track promotion in CIdeploy/ota-updates if you need over-the-air patching between releases============================================================ SELF-EVOLUTION TELEMETRY ============================================================
After producing output, record execution metadata for the /evolve pipeline.
Check if a project memory directory exists:
~/.claude/projects/skill-telemetry.md in that memory directoryEntry format:
### /play-store-publish — {{YYYY-MM-DD}}
- Outcome: {{SUCCESS | PARTIAL | FAILED}}
- Self-healed: {{yes — what was healed | no}}
- Iterations used: {{N}} / {{N max}}
- Bottleneck: {{phase that struggled or "none"}}
- Suggestion: {{one-line improvement idea for /evolve, or "none"}}Only log if the memory directory exists. Skip silently if not found. Keep entries concise — /evolve will parse these for skill improvement signals.
============================================================ DO NOT ============================================================
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.