Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIDeepSeekDeepSeekMuseMuse+22 more

    Play Data Safety Audit: Draft Form Answers With Evidence

    1

    The Data safety form gets filled in once, from memory.

    $9.99

    Secure checkout via Stripe

    Money-back guarantee

    Converts to your local currency at checkout

    Security scanned
    Play Data Safety Audit: Draft Form Answers With Evidence

    Play Data Safety Audit: Draft Form Answers With Evidence

    Example session with this skill installed

    I added two SDKs since I last filled in the Data safety form. Scan this project against my current declaration and tell me which rows are wrong, with the evidence. The Gradle dependencies output is in deps.txt.

    • Read your context and instructions
    • Compiled the play data safety

    draft for review, the developer is responsible for the final declaration.

    Inputs: 2 build files, version catalog, 2 manifests, 1 Kotlin file, deps.txt (18 coordinates the build files never name), your declaration and policy text. Static scan, exit code 1.

    Result: 7 rows with SDK evidence, 2 candidates, 2 under-declared, 1 over-declared, 1 SDK to check by hand, 1 policy gap.

    Under-declaredSharedEvidence
    Crash logsnocom.google.firebase:firebase-crashlytics:19.2.1, app/build.gradle.kts:25
    Device or other IDsyescom.google.android.gms:play-services-ads:23.5.0, three Firebase SDKs, com.unity3d.ads:unity-ads:4.12.5 (transitive), AD_ID permission at app/src/main/AndroidManifest.xml:6

    Candidate, Precise location: ACCESS_FINE_LOCATION at app/src/main/AndroidManifest.xml:5 and a location call at app/src/main/java/com/example/notes/data/LocationRepo.kt:31. That proves access, not transmission. The other candidate, Other actions, applies only if a Unity Ads dashboard setting is on.

    Check by hand: com.example.adkit:ads-bridge:1.4.0 has no map entry. It pulls in a Unity mediation adapter and unity-ads.

    Also: Email address is declared with no evidence in the scan. Diagnostics is missing two purposes. Keyword check only: the policy never mentions location.

    Next: I ask you the report's 7 questions. For the first I read the code around line 31, where the coordinates go to api.attachPlace on line 33, and you confirm whether they leave the device. We open the ads-bridge vendor's disclosure together. You enter the rows in Play Console.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    The Data safety form gets filled in once, from memory. Then someone adds an ads SDK or upgrades a crash reporter, the declaration stops matching what the app sends, and the first sign is a policy email or a blocked update.

    What your agent does

    • Reads the project as it stands: Gradle build files in both DSLs, the version catalog, manifests, Kotlin and Java sources. It never runs Gradle.
    • Follows transitive SDKs when you supply the Gradle dependencies output, so an ad network pulled in by a wrapper library appears with the chain behind it.
    • Drafts one row per data type with collected, shared, purposes and confidence, each tied to a dependency coordinate, a manifest permission or a source line.
    • Diffs the draft against your declaration, under-declared rows first, then over-declared rows and missing purposes.
    • Asks where it can't know: a permission or API call becomes a candidate row with a question, and an SDK outside the map is listed as unknown.
    • Checks around the form: a privacy policy keyword check, and permissions that usually need their own Play Console declaration.

    Built-in guard rails

    • The report opens with "draft for review, the developer is responsible for the final declaration."
    • The agent never logs in to Play Console and never submits the form.
    • SDK facts come only from the bundled map, where each entry cites the vendor's page and the date it was read. Entries older than 180 days are flagged as stale.
    • It's a static scan with no view of network traffic or your backend calls, and the report says so.

    What's inside

    • SKILL.md: ten-step workflow, output guide, hard rules, limits.
    • scripts/datasafety_scan.py: one standard-library script, Markdown and JSON output.
    • 4 data files: an SDK map (34 entries from 21 vendor pages), the 38 Play data types, a utility library list, and a CSV layout map built from Google's sample file and untested against a live export.
    • 6 reference files: form definitions, data types, commonly wrong rows, map maintenance, Gradle inputs, permission declarations.
    • 10 fixture files: a sample app, a dependencies output, a declaration, a policy text.
    • 229 unit tests in 7 test files.

    Find more skills like this on the Claude Skills Marketplace, the Codex Skills Marketplace and the Gemini Skills Marketplace, or browse Claude Skills for Mobile Development.

    Static scan only: no network traffic, backend calls, webview content, AAR or JAR code, and no manifest merge. SDK coverage is a dated map of 34 entries; others are listed as unknown. The CSV reader is untested against a live Play Console export. It can't judge policy compliance.

    How to use

    1. 1

      Connect your agent to the Agensi MCP

      Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup

    2. 2

      Sign in to Agensi

      Your agent shows a sign-in link. Sign in and click Allow.

    3. 3

      Ask for what you need

      Your agent loads this skill and uses it on your task. It always asks before buying a skill.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill goes through the trust checks below.

    Security scanned

    Checked by our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Money-back guarantee

    Doesn't do what its page promises? You get your money back.

    Trust & safety

    Security scan

    Security scan passed today

    Software
    Python 3 (3 point 8 or later)
    Android project with Gradle files
    ormanifests
    Optional
    Gradle release runtime classpath outputYour current Data safety answers as JSONYour privacy policy as plain textWeb access for vendor SDK pages

    Permissions

    Terminal / Shell
    Read Files
    Write Files
    Listedtoday

    What's inside

    Frequently Asked Questions

    No. It writes a draft on your machine, as Markdown and JSON. You enter the rows in Play Console and you own the declaration.

    No. The bundled map has 34 entries, each written from the vendor's own disclosure page with the date it was read. Anything else is listed as "unknown, check the vendor disclosure".

    No. It's a static scan that can't see network traffic, your backend calls or code inside AAR and JAR files. It makes no statement about policy compliance or a review outcome.

    The script never runs it. Without the dependencies output only SDKs written in your build files are checked, so run the one command in the references and pass the text file in.

    New in Mobile Development