play-policy-insights

Play Policy Insights: data safety, login credentials, and restricted permissions

You must audit Android apps for three specific policy domains. You must check data safety, demo login credentials, and restricted permissions.

Path Resolution

• repo_root: Absolute path to the directory containing this SKILL.md.
• app_dir:: Absolute path to the directory containing app's code.
• temp_dir: Absolute path to the scratch directory at the workspace root. It is located at .scratch/play_policy_insights_<uuid>. Containment Mandate: You must confine all file system writes, intermediate artifacts, and logs strictly to this directory. This ensures the skill remains portable and safe across diverse execution environments, including local harnesses and CI/CD pipelines, by avoiding reliance on system-level temporary paths or user home directories.

Critical mandates

• Execution Mode Awareness Before starting Phase 2, evaluate if your execution environment provides a tool to spawn or delegate tasks to general-purpose sub-agents (e.g., tools often named invoke_agent, delegate_task, or spawn_worker, using generic agent profiles like 'generalist' or 'coding_agent').

• If YES, you MUST use Mode A (Delegation).

• If NO, use Mode B (Sequential Self-Execution). You must read the prompt files intended for the subagents, follow their instructions, and write the expected output files to disk.

• Sub-agents orchestration:

  • If you use "Mode A (Delegation)", wait for "SUCCESS" confirmation from sub-agents to know when they are done.

  • Idempotency & Timeout Safeguard: If a sub-agent fails or times out, you MUST verify the presence and integrity of its target output file (e.g., <temp_dir>/worker_<goal_name>.json) before retrying. If the file exists and contains valid JSON, treat the execution as SUCCESS and proceed. Otherwise, retry up to three times.