gsc-ai-performance
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-supplied data from Google Search Console (GSC) CSV exports. Maliciously crafted content within these files could attempt to influence the agent's behavior during parsing or subsequent analysis.
- Ingestion points: The skill reads
02-export.csv, which is an external file supplied by the user. - Boundary markers: No explicit delimiters or instructions are defined to isolate the untrusted CSV data from the agent's core processing logic.
- Capability inventory: The agent executes a Python helper script (
gsc-ai-performance.py) and performs multiple file-write operations to the local data directory. - Sanitization: The skill description does not specify any validation or sanitization routines for the CSV content prior to processing.
- [COMMAND_EXECUTION]: The skill automates the execution of a Python script to parse and archive the performance data.
- Evidence: The
Processsection includes the commandpython "${CLAUDE_PLUGIN_ROOT}/scripts/gsc-ai-performance.py"which is invoked with arguments including brand slugs and file paths. While targeting a local script, this represents an automated command execution pattern triggered by user data.
Audit Metadata