How do I install the Gplay Compliance skill?

Run npx skillmds@latest add unliftedq/gplay-compliance in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Gplay Compliance safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Gplay Compliance?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Gplay Compliance free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Gplay Compliance?

unliftedq (@unliftedq) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Gplay Compliance by unliftedq — Agent Skill

Name: Gplay Compliance
Author: unliftedq

Gplay Compliance

Push and validate an app's Google Play Data Safety declaration with gplay — `compliance datasafety validate` (offline structural check of the canonical CSV) and `compliance datasafety set` (POST the declaration live). Use when updating the Data Safety form from a versioned CSV or gating it in CI. Note this is the ONLY Play compliance surface with an API — content rating, target audience, and ads/news declarations have no endpoint and stay manual in the Play Console.

unliftedq Updated Sep 17, 2026

File contents

gplay compliance (Data Safety)

Manage the app's Data Safety declaration from a canonical CSV. Shared conventions (auth, --package, output, exit codes) are in gplay-cli-usage.

What is and isn't automatable (the hard wall)

Data Safety is the only Play compliance surface with a Developer API endpoint. These neighbouring declarations have no API and cannot be driven by gplay — they remain manual in the Play Console:

Content rating (IARC questionnaire)
Target audience & content / Families
Ads declaration, News-app declaration, Government-app status, COVID-19, etc.

Treat those as a documented manual step in your release runbook; gplay does not and will not automate them. This skill is strictly about Data Safety.

Data Safety is write-only

The declaration is write-only (ADR-0014): a direct POST outside the Edits model that replaces the whole document. gplay cannot read it back — there is no get, only set and an offline validate. The live POST is the only thing that validates the contents against Google's schema.

gplay compliance datasafety validate                       # offline structural check
gplay compliance datasafety set --dry-run                  # rehearse: validate + resolve target + size
gplay compliance datasafety set --confirm                  # the real write — replaces the live declaration

validate structurally checks the CSV offline (no network, no auth).
set pushes the canonical CSV (--file, default ./compliance/data-safety.csv). It runs validate implicitly first, so a structurally invalid CSV never reaches the network. --dry-run rehearses — validates, resolves the target package/Account, and reports "would POST N bytes / N rows" with no HTTP call (and no --confirm needed).
The real write requires --confirm (a stale or wrong declaration can block releases or misstate your data practices); without it set refuses, exits 2, and points you at the flag. CI=true does not auto-confirm.

--output json passes the API response through verbatim. Confirm flags with gplay compliance datasafety set --help.

CI shape

gplay compliance datasafety validate || exit $?           # offline gate, fails on bad CSV
gplay compliance datasafety set --confirm --output json   # publish from versioned CSV

---name: gplay-compliancedescription: Push and validate an app's Google Play Data Safety declaration with gplay — `compliance datasafety validate` (offline structural check of the canonical CSV) and `compliance datasafety set` (POST the declaration live). Use when updating the Data Safety form from a versioned CSV or gating it in CI. Note this is the ONLY Play compliance surface with an API — content rating, target audience, and ads/news declarations have no endpoint and stay manual in the Play Console.---# gplay compliance (Data Safety)Manage the app's **Data Safety** declaration from a canonical CSV. Sharedconventions (auth, `--package`, output, exit codes) are in `gplay-cli-usage`.## What is and isn't automatable (the hard wall)Data Safety is the **only** Play compliance surface with a Developer APIendpoint. These neighbouring declarations have **no API** and cannot be drivenby gplay — they remain manual in the Play Console:- Content rating (IARC questionnaire)- Target audience & content / Families- Ads declaration, News-app declaration, Government-app status, COVID-19, etc.Treat those as a documented manual step in your release runbook; gplay does notand will not automate them. This skill is strictly about Data Safety.## Data Safety is write-onlyThe declaration is **write-only** (ADR-0014): a direct POST **outside** theEdits model that **replaces the whole document**. gplay cannot read it back —there is no `get`, only `set` and an offline `validate`. The live POST is theonly thing that validates the contents against Google's schema.```bashgplay compliance datasafety validate # offline structural checkgplay compliance datasafety set --dry-run # rehearse: validate + resolve target + sizegplay compliance datasafety set --confirm # the real write — replaces the live declaration```- **`validate`** structurally checks the CSV **offline** (no network, no auth).- **`set`** pushes the canonical CSV (`--file`, default `./compliance/data-safety.csv`). It runs `validate` implicitly first, so a structurally invalid CSV never reaches the network. `--dry-run` rehearses — validates, resolves the target package/Account, and reports "would POST N bytes / N rows" with no HTTP call (and no `--confirm` needed).- The real write **requires `--confirm`** (a stale or wrong declaration can block releases or misstate your data practices); without it `set` refuses, exits `2`, and points you at the flag. `CI=true` does not auto-confirm.`--output json` passes the API response through verbatim. Confirm flags with`gplay compliance datasafety set --help`.## CI shape```bashgplay compliance datasafety validate || exit $? # offline gate, fails on bad CSVgplay compliance datasafety set --confirm --output json # publish from versioned CSV```

Frequently asked questions