Trust Assessment
gsc received a trust score of 86/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include OAuth Credentials Printed to Standard Output During Setup.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 11, 2026 (commit 0676c56a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | OAuth Credentials Printed to Standard Output During Setup The `gsc_auth.py` script, designed for initial OAuth setup, prints the generated Google Client ID, Client Secret, and Refresh Token directly to standard output. While this is intended for the user to manually configure their `.env` file, it exposes these sensitive credentials in plain text. If the environment where this script is executed is compromised or if standard output is logged by the agent's execution environment, these credentials could be captured, leading to unauthorized access to the user's Google Search Console data. 1. **Secure Output**: Instead of printing to stdout, consider writing these credentials directly to a securely configured `.env` file (if the skill's execution environment allows for secure file writing) or providing a more secure mechanism for credential transfer. 2. **Warning**: Add a prominent warning to the user about the sensitivity of these credentials and the importance of securing their `.env` file and execution environment. 3. **Ephemeral Display**: If printing is necessary, ensure the display is ephemeral and not persistently logged by the agent's environment. | LLM | scripts/gsc_auth.py:80 |
Scan History
Embed Code
[](https://skillshield.io/report/ba7e61c587de0479)
Powered by SkillShield