storePassword "..." sits in build.gradle, the release build type is still signed with signingConfigs.debug, and targetSdk = 35 no longer passes Google Play for phone apps since 31 August 2026. This skill finds those and eleven other release-build mistakes in your Gradle files before you upload, and tells you how to fix each one.

Your agent runs a scanner on build.gradle and build.gradle.kts files (app and library modules, the root build file, settings files and shared files such as Capacitor's variables.gradle), gradle.properties, local.properties, keystore.properties, key.properties and signing.properties, gradle/libs.versions.toml, R8 rule files (proguard-rules.pro, consumer-rules.pro, keepRules/*.keep) and the names of keystore files. It skips comments, follows Gradle blocks the way Gradle reads them (buildTypes { release { } }, getByName("release"), named("release"), android.buildTypes.release...), reads Kotlin DSL calls whose arguments sit on separate lines, follows simple values defined in the same file (React Native's enableProguardInReleaseBuilds, ext { targetSdkVersion = 33 }), tells Wear OS, TV, Automotive and XR modules from phone apps by their dependencies, and leaves out signing files and keystores that a .gitignore covers. It works with Android Studio, Flutter, React Native, Expo, Capacitor and Kotlin Multiplatform projects. It never runs Gradle or your code. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Secrets are never printed.

What it checks

BLOCK (fix before shipping)

• A01: storePassword or keyPassword written in a build file (also as a fallback after System.getenv, getOrElse or orElse), signing passwords in the project's gradle.properties, and keystore.properties, key.properties, signing.properties or local.properties files with passwords that no .gitignore excludes
• A02: debuggable true or isDebuggable = true in the release build type
• A03: the release build type signed with the debug signing config, or a release signing config that points at debug.keystore (unless it is a template placeholder or the project injects its release key: see A18)
• A04: a targetSdk Google Play no longer accepts: below 34 anywhere, below 35 in Wear OS and Android Automotive OS modules, below 36 in app modules whose dependencies show a phone or tablet app
• A05: literal secrets, tokens, passwords and API keys in buildConfigField, resValue or manifestPlaceholders (keys made to ship in apps, such as Google Maps, publishable and analytics SDK keys, are not reported)
• A06: .jks or .keystore files (or base64 copies of them) in the project that no .gitignore excludes

REVIEW (check before release)

• A11: R8 off for the release build of an app module: minifyEnabled false, optimization { enable = false }, or a release block that never turns it on
• A12: targetSdk 34 or 35 where the form factor cannot be seen (shared ext block, variables.gradle, gradle.properties, version catalog)
• A13: jniDebuggable true in the release build type
• A14: an Android Gradle plugin older than 8.5.1 (unless the documented legacy-packaging workaround is set) or an NDK older than r27, not ready for Google Play's 16 KB page size requirement
• A15: -dontobfuscate, -dontoptimize, -dontshrink or keep-everything rules in R8 rule files, getDefaultProguardFile("proguard-android.txt"), or android.enableR8.fullMode=false
• A16: lint checkReleaseBuilds false
• A17: APK Signature Scheme v2 turned off without v3 in a release signing config
• A18: the debug signing config on the release build type as a placeholder: the template's TODO or Caution comment is right above it (Flutter, React Native, Expo), or the project injects its release key through EAS Build or android.injected.signing

What's included

• The scanner (Python 3.9+, standard library only)
• A rules guide with the reason, safer approach and official Android documentation link for each rule
• A risky and a safe example project, and the real report the scanner produces on the risky one

Limits

It reads each file as written: values set at build time, catalog accessors such as libs.versions.targetSdk, convention plugins in buildSrc or build-logic and flutter.targetSdkVersion are not followed, and product flavors, custom build types and the variant API are not treated as the release build. The form factor is read only from a module's own dependencies. AndroidManifest.xml and app source code are not read. A file git already tracks stays in the repository even after it is added to .gitignore. The target SDK and 16 KB rules follow Google Play's requirements as of November 2026. The Flutter and React Native templates sign release with the debug key; this is reported as A18 (REVIEW), because a build that does not get a release key from EAS Build, Android Studio's Generate Signed Bundle wizard or your CI is rejected by Google Play. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 27 files: SKILL.md, the scanner in scripts/ (7 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (17 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.