Google Search Console CLI

PassAudited by ClawScan on May 1, 2026.

Overview

This is a straightforward Google Search Console CLI guide, but it involves installing an external CLI and using Google OAuth credentials that can read or change Search Console data.

Before installing, verify the external package source, keep OAuth client secrets and stored credentials private, use readonly login unless you need write access, and review any site or sitemap mutation command before running it.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If installed and used, the CLI may access Google Search Console data for properties the Google account can reach, and non-readonly login can support write operations.

Why it was flagged

The skill instructs users to authenticate with a Google OAuth client secret and stores resulting credentials locally. This is expected for Google Search Console access, but it grants account-scoped API authority.

Skill content
gsc auth login --client-secret /absolute/path/to/client_secret.json ... Default storage paths: credentials: `~/.config/gsc-cli/credentials.json`
Recommendation

Use `--readonly` for read-only tasks, protect the client secret and stored credentials, and only authenticate Google accounts/properties you intend the CLI to access.

What this means

Running write commands could add a site entry or submit/delete sitemap records for a Search Console property.

Why it was flagged

The command reference includes operations that can change Search Console state. They are purpose-aligned and documented, but should be run intentionally.

Skill content
`gsc site add [--site SITE]` ... `gsc sitemap submit [--site SITE] --feedpath TEXT` ... `gsc sitemap delete [--site SITE] --feedpath TEXT`
Recommendation

Confirm the target property and sitemap path before write commands, and prefer readonly authentication when you only need listing, inspection, or analytics.

What this means

Installing the package will execute and use code from the package source selected by pipx/pip.

Why it was flagged

The recommended setup installs an external, unpinned package. This is a normal CLI installation path, but the installed package code is not included in the provided artifacts.

Skill content
python3 -m pip install --user pipx ... pipx install google-search-console-cli
Recommendation

Verify the package name and publisher before installing, consider pinning a known version, and use pipx or a virtual environment to keep it isolated.