Google Search Console CLI

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 12:31 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward guide for installing and using a Google Search Console CLI, with expected OAuth and local credential handling disclosed.

Before installing, confirm you trust the google-search-console-cli package source, prefer read-only OAuth when you only need reporting, keep the downloaded OAuth client JSON private, and protect the local credential files because they authorize access to your Search Console properties.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:27
• Finding: Unpinned Third-Party CLI Installation Creates Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md`, lines 27–30 **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium **Complete Code Snippet**: ```bash python3 -m pip install --user pipx python3 -m pipx ensurepath pipx install google-search-console-cli gsc --version ``` ### Technical Analysis The Skill instructs users to install both `pipx` and `google-search-console-cli` from the configured Python package index without pinning reviewed versions, validating cryptographic hashes, specifying a trusted package index, or supplying a lockfile. Package installation may execute package-controlled build and installation logic under the user's account. This is particularly sensitive because the installed `gsc` program is subsequently entrusted with an OAuth client-secret file and Google authorization tokens. The project contains only `SKILL.md`, so the implementation and transitive dependencies of the externally installed CLI could not be audited. This finding does not establish that the named package is malicious; it identifies the mutable and insufficiently verified dependency installation process as a supply-chain weakness. ### Attack Path 1. A user follows the documented installation commands. 2. `pip` or `pipx` resolves mutable packages and their transitive dependencies through the user's configured package index. 3. An attacker compromises a package release, dependency, maintainer account, or configured package source. 4. Malicious package-controlled logic executes during installation or when `gsc` is invoked. 5. When the user later authenticates, the compromised CLI can access the supplied OAuth client-secret file and locally stored OAuth credentials. 6. The malicious code can abuse the user's operating-system permissions or make unauthorized Search Console API requests within the granted OAuth scopes. ### Impact Assessment Exploitation could provide arbitrary code exec ...[truncated 685 chars]
• Remediation: ## Remediation Suggestions 1. Pin `pipx`, `google-search-console-cli`, and relevant transitive dependencies to reviewed versions. 2. Distribute a requirements or lock file containing cryptographic hashes and install with hash verification. 3. Explicitly specify and document the trusted package index rather than relying on ambient package-manager configuration. 4. Publish package provenance, signatures, or attestations and document how users can verify downloaded artifacts. 5. Prefer installation from a reviewed source revision or signed release artifact. 6. Run the CLI in an isolated environment and avoid granting it broader filesystem permissions than required. 7. Recommend `--readonly` whenever write operations are unnecessary, reducing the impact of credential compromise. 8. Document restrictive permissions for credential files and advise users not to place credentials in shared directories.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Credential Access

High

• Category: Privilege Escalation

Content

Preferred login flow:

```bash
gsc auth login --client-secret /absolute/path/to/client_secret.json
```

Useful auth options:

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

```

Default storage paths:
- credentials: `~/.config/gsc-cli/credentials.json`
- app config: `~/.config/gsc-cli/config.json`

Env overrides:

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Session Persistence

Medium

• Category: Rogue Agent

Content

## OAuth Client Setup In Google Cloud (Desktop App)

As of February 26, 2026, create OAuth client credentials in Google Cloud Console using these steps:

1. Open Google Cloud Console and select/create a project.
2. Enable the Search Console API for that project.

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The markdown states a default of `--language-code en-US`, which imposes a specific locale in the skill guidance. Under the policy, forcing a language or locale without user opt-in or clear justification is a natural-language policy concern.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The skill explains how to authenticate and later notes the default credential storage path, but it does not explicitly warn users up front that running login will create local credential files and may launch a browser. Because this behavior affects privacy and local system state, a brief user-facing warning would improve safety disclosure.

Static analysis

No suspicious patterns detected.