Automate this: /mobile-release:preflight runs this audit against the real project, no credentials
needed. The App content forms it checks are human-only — see
skills/release-automation/references/human-only.md §4 for what an agent can prepare for each instead.
Audit a Google Play listing and its policy declarations before submission. Run every section in order and report PASS, WARN, or FAIL for each. Do not ask which sections to run — run them all. Load only the reference you need for detail.
Confidence marks used throughout this skill and its references: [verified] — read off a primary vendor source on 2026-08-05. [snippet] — secondary source only, plausible but unconfirmed. [unverified] — not confirmed anywhere; run the check given before relying on it.
Audit process:
- Read the manifest and Gradle config. Extract
applicationId,versionCode,versionName,targetSdk, and everyuses-permission. Everything below depends on these. - Walk the pre-submission checklist below, section by section.
- Check assets and metadata against
references/asset-specs.md. Every number there is unverified — surface that to the user, do not present specs as authoritative. - Check the App content declarations using
references/app-content.md. - Check restricted permissions against
references/restricted-permissions.md. Propose the narrower API alternative before proposing a declaration form. - Check the launch timeline using
references/launch-timeline.md— a new personal developer account cannot reach production quickly. - Preempt rejections using
references/rejection-reasons.md. - Produce the summary table in the Output Format below.
Uploading the binary is the play-store-publish skill. This skill is about whether pressing publish is safe.
Contents
- Pre-submission checklist
- Confidence and freshness
- Output Format
- References
Pre-submission checklist
1. Build and technical gates
- Artifact is a signed
.aab(mandatory for new apps since August 2021; TV apps since June 2023) -
versionCodeis higher than every code ever uploaded to this app -
targetSdkmeets the current Play floor — from 2026-08-31, API 36 for phone/tablet, 35 for Wear OS and Automotive, 34 for TV and XR. An extension to 2026-11-01 can be requested per-app in Play Console -
isMinifyEnabledis on for release, andmapping.txtwill be uploaded - No
android:debuggable="true", no cleartext traffic, no exported components that should not be - No hardcoded API keys or secrets in the bundle
- Total install download is under the 4 GB cap (
bundletool get-size total --apks=app.apks) - App launches on a clean install and the core feature is reachable in the first minute
2. Store listing content
- App name, short description, full description present for the default locale and every locale you ship
- Every non-default locale is complete — a partially translated listing looks broken, not multilingual
- No placeholder text, no "coming soon", no Lorem Ipsum
- Title is not keyword-stuffed and contains no ranking claims ("#1", "Best")
- Icon, feature graphic, and phone screenshots uploaded (see
references/asset-specs.md) - Screenshots show the actual current build — stale UI is a misleading-metadata rejection
- Screenshots contain no fake ratings, no app-store badges, no device frames on Wear
- Category and tags match what the app does
3. Promo video (optional, but constrained)
The promo video is a YouTube URL typed into Play Console, never a file upload. The Publishing API Listing.video field is "URL of a promotional YouTube video for the app" (verified from the discovery document); fastlane supply stores it as video.txt.
- Full
youtube.com/watch?v=…link, not ayoutu.beshort link, not a playlist or channel URL - Video is public, embeddable, and not age-restricted
- Monetization is off so no ad plays before your app's video
- Feature graphic exists — it is what Play shows when the video does not autoplay
All bullets in this section except the API field description are [snippet], unverified.
4. App content declarations
Play Console → App content. Every one of these blocks production until complete.
- Privacy policy URL — publicly accessible, stable, covers this app specifically
- Data safety form — matches actual app and third-party SDK behaviour
- Content rating (IARC) questionnaire — completed, and re-answered if content changed
- Ads declaration — drives the "Contains ads" badge
- Target audience and content — any under-13 band puts the app into Designed for Families with stricter ad and content rules
- Conditional forms as applicable: government apps, financial features, health, news, data deletion
Detail and the SDK-audit method: references/app-content.md.
5. Restricted permissions
For every uses-permission in the manifest, ask: does Play require a declaration form for this, and is there a narrower API that avoids it?
-
QUERY_ALL_PACKAGES— replace with<queries>elements unless the app is an accessibility, browser, device-management, security, or antivirus app -
ACCESS_BACKGROUND_LOCATION— only where background location is a core feature; declaration plus a demo video required -
MANAGE_EXTERNAL_STORAGE— replace with the Storage Access Framework or MediaStore unless the app is a file manager, backup, antivirus, document manager, on-device search, encryption, or migration tool - SMS / Call Log group — only for the registered default SMS, Phone, or Assistant handler, and default-handler status must be requested before the permissions
-
READ_MEDIA_IMAGES/READ_MEDIA_VIDEO— replace with the Android photo picker for one-time or limited access -
USE_EXACT_ALARM— limited eligible use cases; prefer user-grantedSCHEDULE_EXACT_ALARMgated onalarmManager.canScheduleExactAlarms() -
AD_ID— must be declared in the manifest for API 33+ and in the Data safety form - Anything unused — delete it. Unused permissions are a free rejection
Full policy text, permitted categories, and alternatives: references/restricted-permissions.md.
6. Launch timeline
- If this is a new personal developer account: a closed test with at least 12 testers continuously opted in for 14 days is required before production access can be requested.
[snippet — see references/launch-timeline.md]. Budget three weeks minimum; do not promise same-day publishing - Pre-launch report reviewed — it runs automatically on bundles uploaded to closed and open testing and reports crashes, performance, accessibility, and security findings on real Firebase Test Lab devices
- Managed publishing checked — if it is on, an approved release still will not go live until you release it
- Demo account credentials supplied to reviewers if the app has a login wall
Confidence and freshness
Research date for this skill: 2026-08-05.
Play Console Help was unreachable during research, so the asset dimensions, file-size caps, screenshot counts, metadata character limits, promo video rules, and the 12-testers/14-days rule could not be verified from a primary source. They are marked [snippet] or [unverified] in references/asset-specs.md and references/launch-timeline.md.
Never present those numbers as authoritative. Tell the user to confirm the current values in Play Console itself — the upload form rejects a wrong-sized asset immediately and is the fastest ground truth — or in Play Console Help. The Publishing API discovery document at https://www.googleapis.com/discovery/v1/apis/androidpublisher/v3/rest is public, needs no auth, and is the authority for anything API-shaped.
Output Format
Report as a results table, then FAIL items, then WARN items, then recommendations. Cite the specific file, manifest line, or Console page for each finding. Skip nothing.
Example output:
Play listing audit — com.example.notes
Date: 2026-08-05 · versionCode 143 · targetSdk 35
| # | Check | Status | Notes |
|---|---|---|---|
| 1 | Build and technical gates | FAIL | targetSdk = 35; API 36 required for updates from 2026-08-31 |
| 2 | Store listing content | WARN | de-DE locale has title.txt but no full_description.txt |
| 3 | Promo video | PASS | Not set; optional |
| 4 | App content declarations | FAIL | Data safety omits the advertising ID |
| 5 | Restricted permissions | FAIL | QUERY_ALL_PACKAGES present, no eligible category |
| 6 | Launch timeline | WARN | Personal account; closed-test requirement likely applies |
Critical issues (FAIL — must fix before submission)
1. targetSdk is below the Play floor. app/build.gradle.kts:34.
// Before
targetSdk = 35
// After
targetSdk = 36
Uploads targeting 35 are accepted today but blocked from 2026-08-31 unless a per-app extension to 2026-11-01 is granted.
2. QUERY_ALL_PACKAGES is declared with no eligible use. app/src/main/AndroidManifest.xml:11. The app uses it only to check whether a maps app is installed. Play permits this permission for accessibility, browser, device-management, security, and antivirus apps only. Use a <queries> element instead — no declaration form, no review:
<!-- Before -->
<uses-permission android:name="android.permission.QUERY_ALL_PACKAGES" />
<!-- After -->
<queries>
<intent>
<action android:name="android.intent.action.VIEW" />
<data android:scheme="geo" />
</intent>
</queries>
3. Data safety form omits the advertising ID. The build includes play-services-ads:23.x, which reads the advertising ID. Declare Device or other IDs → Advertising ID under both Collected and Shared, add com.google.android.gms.permission.AD_ID to the manifest, and state the purpose. A Data safety answer that contradicts SDK behaviour is one of the most common rejection causes.
Warnings
de-DElisting is incomplete.fastlane/metadata/android/de-DE/full_description.txtis missing. Either complete it or remove the locale.- Closed-testing requirement may gate production. If this is a personal developer account created after November 2023, expect a 12-tester / 14-day closed test before production access. Unverified — confirm on the Play Console Dashboard, which shows the requirement and progress directly.
Recommendations
- Add four 10-inch tablet screenshots. The app is
resizeableActivity, so it will be surfaced to large-screen users with phone screenshots otherwise. - Upload
mapping.txtwith the release so Play crash reports deobfuscate. - Re-run the audit after the fixes and before pressing Send for review.
Verify before shipping: the asset dimensions and character limits used in this audit could not be confirmed against Play Console Help (blocked at research time, 2026-08-05). Confirm them in the Play Console upload form.
End of example.
References
references/asset-specs.md— icon, feature graphic, phone/tablet/Wear/TV screenshot dimensions, formats, counts, file-size caps, and metadata character limits. Every row carries a confidence marking.references/app-content.md— Data safety form, IARC content rating, privacy policy, ads declaration, target audience and Families policy, and how to audit third-party SDKs against your answers.references/restricted-permissions.md— which permissions force a declaration form, the permitted categories for each, and the narrower API that avoids the form.references/launch-timeline.md— new-account closed-testing requirement, pre-launch report, review timelines, managed publishing, and staged-launch planning.references/rejection-reasons.md— ranked rejection causes, how to preempt each, and what to do after a rejection.