The Agent Skills Directory

[SAFE]: The skill implements a standard OAuth 2.0 flow for Google Search Console and uses API keys for PageSpeed Insights. Credentials and configuration are stored locally in the user's home directory (~/.config/skills/gsc/).
[SAFE]: The configuration management logic in src/gsc/config.py includes a masking function to prevent secrets from being displayed in plain text when using the config show command.
[EXTERNAL_DOWNLOADS]: The skill fetches data from official Google APIs (Search Console and PageSpeed Insights). These are well-known, trusted services.
[DATA_EXFILTRATION]: The PageSpeed Insights implementation in src/gsc/pagespeed.py transmits the configured API key as a query parameter to pagespeedonline.googleapis.com. While generally discouraged due to potential logging exposure, this is the standard authentication method for this specific Google API.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data (SEO analytics, URL inspection results, and Lighthouse audits). While this creates an attack surface for indirect prompt injection (e.g., if a page title or search query contains malicious instructions), the risk is low as the output is structured JSON and the skill lacks capabilities that would allow high-impact exploitation.

google-search-console