Security audit
Security checks for vulnerabilities and agentic risk
This is a small documentation-only indexing skill whose network and credential needs are expected for its stated SEO purpose, with no hidden code or persistence.
Install only if you intend to submit URLs for sites you own or administer. Before using it, confirm the exact domain, URL list or sitemap, and target engines; keep Google service-account credentials and access tokens out of chat when possible and use secure secret handling.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
1. Create a service account in Google Cloud Console
2. Enable the Indexing API
3. Add the service account email as an owner in Google Search Console
4. Generate an access token
## Supported Engines
The skill describes submitting URLs and using Google service-account-based indexing, but it does not warn users that URLs, sitemap contents, API keys, service account identifiers, and related metadata may be transmitted to external services. This lack of disclosure can lead users to expose sensitive site structure or credential-related information without informed consent, especially in automated agent workflows.
The skill activates on a vague condition like 'when asked to submit URLs for indexing' without requiring explicit confirmation of target domains, ownership, scope, or user intent. That broad trigger can cause the agent to facilitate submission of arbitrary URLs to external indexing services, including third-party sites, making misuse easier and increasing the chance of unauthorized actions.
No suspicious patterns detected.