Gplay compliance

Skill unliftedq/agents/android-dev/skills/gplay-compliance

Push and validate an app's Google Play Data Safety declaration with gplay — `compliance datasafety validate` (offline structural check of the canonical CSV) and `compliance datasafety set` (POST the declaration live). Use when updating the Data Safety form from a versioned CSV or gating it in CI. Note this is the ONLY Play compliance surface with an API — content rating, target audience, and ads/news declarations have no endpoint and stay manual in the Play Console.From its SKILL.md

Install

npx -y skills add unliftedq/agents --skill gplay-compliance

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

2.8 KB, 552 tokens by cl100k_base, as published. Nobody here has run it

gplay compliance (Data Safety)

Manage the app's Data Safety declaration from a canonical CSV. Shared conventions (auth, --package, output, exit codes) are in gplay-cli-usage.

What is and isn't automatable (the hard wall)

Data Safety is the only Play compliance surface with a Developer API endpoint. These neighbouring declarations have no API and cannot be driven by gplay — they remain manual in the Play Console:

Content rating (IARC questionnaire)
Target audience & content / Families
Ads declaration, News-app declaration, Government-app status, COVID-19, etc.

Treat those as a documented manual step in your release runbook; gplay does not and will not automate them. This skill is strictly about Data Safety.

Data Safety is write-only

The declaration is write-only (ADR-0014): a direct POST outside the Edits model that replaces the whole document. gplay cannot read it back — there is no get, only set and an offline validate. The live POST is the only thing that validates the contents against Google's schema.

gplay compliance datasafety validate                       # offline structural check
gplay compliance datasafety set --dry-run                  # rehearse: validate + resolve target + size
gplay compliance datasafety set --confirm                  # the real write — replaces the live declaration

validate structurally checks the CSV offline (no network, no auth).
set pushes the canonical CSV (--file, default ./compliance/data-safety.csv). It runs validate implicitly first, so a structurally invalid CSV never reaches the network. --dry-run rehearses — validates, resolves the target package/Account, and reports "would POST N bytes / N rows" with no HTTP call (and no --confirm needed).
The real write requires --confirm (a stale or wrong declaration can block releases or misstate your data practices); without it set refuses, exits 2, and points you at the flag. CI=true does not auto-confirm.

--output json passes the API response through verbatim. Confirm flags with gplay compliance datasafety set --help.

CI shape

gplay compliance datasafety validate || exit $?           # offline gate, fails on bad CSV
gplay compliance datasafety set --confirm --output json   # publish from versioned CSV

What ships with it: 1 file

221 B alongside SKILL.md

.kman-skill.json221 B