Google Search Console CLI

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 12:31 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward guide for installing and using a Google Search Console CLI, with expected OAuth and local credential handling disclosed.

Before installing, confirm you trust the google-search-console-cli package source, prefer read-only OAuth when you only need reporting, keep the downloaded OAuth client JSON private, and protect the local credential files because they authorize access to your Search Console properties.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:27

Finding

Unpinned Third-Party CLI Installation Creates Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 27–30
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Complete Code Snippet:

bash

python3 -m pip install --user pipx
python3 -m pipx ensurepath
pipx install google-search-console-cli
gsc --version

Technical Analysis

The Skill instructs users to install both pipx and google-search-console-cli from the configured Python package index without pinning reviewed versions, validating cryptographic hashes, specifying a trusted package index, or supplying a lockfile. Package installation may execute package-controlled build and installation logic under the user's account.

This is particularly sensitive because the installed gsc program is subsequently entrusted with an OAuth client-secret file and Google authorization tokens. The project contains only SKILL.md, so the implementation and transitive dependencies of the externally installed CLI could not be audited. This finding does not establish that the named package is malicious; it identifies the mutable and insufficiently verified dependency installation process as a supply-chain weakness.

Attack Path

1. A user follows the documented installation commands.
2. pip or pipx resolves mutable packages and their transitive dependencies through the user's configured package index.
3. An attacker compromises a package release, dependency, maintainer account, or configured package source.
4. Malicious package-controlled logic executes during installation or when gsc is invoked.
5. When the user later authenticates, the compromised CLI can access the supplied OAuth client-secret file and locally stored OAuth credentials.
6. The malicious code can abuse the user's operating-system permissions or make unauthorized Search Console API requests within the granted OAuth scopes.

Impact Assessment

Exploitation could provide arbitrary code exec ...[truncated 685 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin pipx, google-search-console-cli, and relevant transitive dependencies to reviewed versions.
2. Distribute a requirements or lock file containing cryptographic hashes and install with hash verification.
3. Explicitly specify and document the trusted package index rather than relying on ambient package-manager configuration.
4. Publish package provenance, signatures, or attestations and document how users can verify downloaded artifacts.
5. Prefer installation from a reviewed source revision or signed release artifact.
6. Run the CLI in an isolated environment and avoid granting it broader filesystem permissions than required.
7. Recommend --readonly whenever write operations are unnecessary, reducing the impact of credential compromise.
8. Document restrictive permissions for credential files and advise users not to place credentials in shared directories.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

Preferred login flow:

bash

gsc auth login --client-secret /absolute/path/to/client_secret.json

Useful auth options:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

text

Default storage paths:
- credentials: `~/.config/gsc-cli/credentials.json`
- app config: `~/.config/gsc-cli/config.json`

Env overrides:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md

## OAuth Client Setup In Google Cloud (Desktop App)

As of February 26, 2026, create OAuth client credentials in Google Cloud Console using these steps:

1. Open Google Cloud Console and select/create a project.
2. Enable the Search Console API for that project.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The markdown states a default of --language-code en-US, which imposes a specific locale in the skill guidance. Under the policy, forcing a language or locale without user opt-in or clear justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill explains how to authenticate and later notes the default credential storage path, but it does not explicitly warn users up front that running login will create local credential files and may launch a browser. Because this behavior affects privacy and local system state, a brief user-facing warning would improve safety disclosure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.