gsc-analyzer
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill workflow involves executing a local Python script (
scripts/parse_gsc_data.py) to parse zip and CSV files. This utilizes the environment's compute resources to perform file operations and data processing. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted search query data from external Google Search Console exports, which could contain malicious instructions designed to influence the agent's behavior during analysis.
- Ingestion points: Data enters the system via
scripts/parse_gsc_data.pywhen reading CSV or Zip exports. - Boundary markers: The skill lacks explicit delimiters or specific instructions for the agent to treat search query content as data rather than instructions.
- Capability inventory: The agent can perform file system reads/writes and execute commands via the provided Python utility.
- Sanitization: There is no evidence of text sanitization or filtering to prevent prompt injection patterns from being passed into the agent's reasoning context.
Audit Metadata