Google Search Console

ReviewAudited by ClawScan on May 1, 2026.

Overview

This appears to be a transparent Google Search Console integration, but it requires a Maton API key/OAuth connection and can read Search Console data or make user-approved sitemap changes.

This skill is coherent for Google Search Console use. Install it only if you trust Maton with managed OAuth access, set the API key securely, choose the correct connection when multiple accounts exist, and require clear confirmation before any sitemap or connection deletion/change.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI03: Identity and Privilege Abuse

What this means

The agent can access Search Console data for the connected Google account when given the Maton key and OAuth connection.

Why it was flagged

The skill requires a Maton API key and uses managed OAuth to access the connected Google Search Console account, which is sensitive but aligned with the stated integration purpose.

Skill content

Maton proxies requests to `www.googleapis.com` and automatically injects your OAuth token. ... Authorization: Bearer $MATON_API_KEY

Recommendation

Use only the intended Google account and connection, keep the Maton API key private, and revoke unused connections when finished.

Medium

#ASI02: Tool Misuse and Exploitation

What this means

Approved write or delete calls could change sitemap settings and affect how Google indexes the site.

Why it was flagged

The API reference includes mutating sitemap operations, but the artifact also instructs the agent to confirm write actions with the user first.

Skill content

PUT /google-search-console/webmasters/v3/sites/{siteUrl}/sitemaps/{feedpath}
DELETE /google-search-console/webmasters/v3/sites/{siteUrl}/sitemaps/{feedpath}
...
**All write operations require explicit user approval.**

Recommendation

Before approving any write or delete operation, verify the site URL, sitemap path, target account, and intended effect.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Search Console requests and responses are mediated by Maton, which users must trust to handle the OAuth connection and API data appropriately.

Why it was flagged

Requests are routed through Maton’s API gateway rather than directly to Google, so Search Console API traffic depends on that third-party service boundary.

Skill content

Base URL

https://api.maton.ai/google-search-console/{native-api-path}

Maton proxies requests to `www.googleapis.com`

Recommendation

Review Maton’s account, connection, and data-handling practices before connecting sensitive Search Console properties.