ClawHub
Back to skill

Security audit

Google Search Console CLI

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its Google Search Console purpose, but it tells agents to install an unpinned global CLI and includes account-changing Search Console commands without explicit confirmation guardrails.

Install only if you trust the npm package and the Google account used with it. Prefer read-only Search Console credentials for analysis, avoid global installation where possible, and require explicit confirmation before adding or removing sites or submitting or deleting sitemaps.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:28
Finding

Unpinned Global Installation of a Third-Party npm Package

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:28
Vulnerability Type: Insecure third-party dependency installation
Risk Level: Medium

Vulnerable Code:

bash
npm install -g google-search-console-cli

Technical Analysis

The Skill instructs the Agent to install the latest available version of google-search-console-cli globally without pinning a reviewed version or verifying package integrity. Consequently, the code installed at execution time can differ from the code present when the Skill was audited.

npm installation can execute package lifecycle scripts. A malicious release, compromised publisher account, or compromised transitive dependency could therefore execute arbitrary code with the privileges of the user running the Agent. Global installation also makes the package available beyond the current task and increases the scope and duration of exposure.

The documentation link to the package's GitHub repository does not cryptographically establish that the npm artifact corresponds to reviewed source code.

Attack Path

  1. An attacker compromises the npm package, its publisher account, or a transitive dependency and publishes a malicious version.
  2. The required CLI is absent from the target environment.
  3. The Agent follows SKILL.md:28 and runs the unpinned global installation command.
  4. Malicious package code or an npm lifecycle script executes during installation.
  5. The payload runs with the installing user's privileges and may access files, environment variables, or credentials available to that user.
  6. The globally installed malicious CLI can subsequently execute whenever the Skill invokes apparently legitimate Search Console commands.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the installing user's account. Accessible assets may include Google service-account credentials, Google Application Default Credentials, Search Consol ...[truncated 390 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the CLI to a specifically reviewed release rather than installing the latest version.
  • Verify the package using an approved lockfile, npm integrity metadata, signed provenance, or a trusted artifact checksum.
  • Avoid global installation; use a project-local, isolated environment with minimal filesystem and network permissions.
  • Where compatible with the verified package, disable npm lifecycle scripts during installation and explicitly audit any scripts that are required.
  • Confirm that the npm publisher and artifact correspond to the referenced source repository.
  • Run the CLI under a dedicated low-privilege account with only the required Search Console properties and API permissions.
  • Use read-only Google credentials for analytics, inspection, and listing workflows. Require explicit user confirmation before invoking site-add, site-remove, sitemap-submit, or sitemap-delete.
  • Protect ~/.config/google-search-console-cli/credentials.json and Application Default Credentials with restrictive filesystem permissions, and never print or copy their contents into prompts or logs.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md
1. `--credentials <path>` flag (per-command)
2. `GOOGLE_APPLICATION_CREDENTIALS` env var
3. `~/.config/google-search-console-cli/credentials.json` (auto-detected)
4. gcloud Application Default Credentials

Before running any command, verify credentials are configured by running `google-search-console-cli sites`. If it fails with a credentials error, ask the user to set up authentication.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill documents destructive commands such as site removal and sitemap deletion/submission without requiring explicit user confirmation, warning about irreversible effects, or recommending a read-only default workflow. In an agent setting, this increases the risk that the model may execute write operations from ambiguous or overly broad user requests, causing unauthorized changes to Search Console properties or sitemap state.

Content

No source excerpt is available for this finding.

Excessive Permissions

Low
Category
Privilege Escalation
Confidence
70% confidence
Finding

Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

md
# Get info about a specific site
google-search-console-cli site <siteUrl>

# Add a site (requires Full permission)
google-search-console-cli site-add <siteUrl>

# Remove a site (requires Full permission)

Excessive Permissions

Low
Category
Privilege Escalation
Confidence
70% confidence
Finding

Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

md
# Get info about a specific site
google-search-console-cli site <siteUrl>

# Add a site (requires Full permission)
google-search-console-cli site-add <siteUrl>

# Remove a site (requires Full permission)

Excessive Permissions

Low
Category
Privilege Escalation
Confidence
70% confidence
Finding

Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

md
# Get info about a specific site
google-search-console-cli site <siteUrl>

# Add a site (requires Full permission)
google-search-console-cli site-add <siteUrl>

# Remove a site (requires Full permission)

Excessive Permissions

Low
Category
Privilege Escalation
Confidence
70% confidence
Finding

Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

md
# Get info about a specific site
google-search-console-cli site <siteUrl>

# Add a site (requires Full permission)
google-search-console-cli site-add <siteUrl>

# Remove a site (requires Full permission)

Static analysis

No suspicious patterns detected.