gsc-automation — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited gsc-automation (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use the gsc-mcp MCP server to pull live Search Console data. This skill tells you when to reach for which tool and in what order.
sc-domain:example.com vs https://example.com/ with trailing slash). Getting it wrong wastes a tool call.If the user has never used this skill before, or a tool call returns an auth error:
Call: gsc_health_checkIf token_valid: false or sites_accessible is empty, tell the user:
Looks like the GSC MCP server needs to be authenticated. In a terminal, run: gsc-mcp auth Then retry.If credentials.json is missing entirely, point them at the README setup steps. Don't try to fix it yourself — auth happens outside the chat.
1. gsc_list_sites → confirm site URL format
2. gsc_top_queries(site, days=28, limit=25) → top queries by clicks
3. gsc_top_pages(site, days=28, limit=25) → top pages by clicks
4. Surface: top 3 winning queries, top 3 declining pages,
any pages with high impressions + low CTR (improvement targets).1. gsc_inspect_url(site, url)
2. Surface: verdict (PASS/NEUTRAL/FAIL), coverage state, Google-chosen canonical
(flag if it differs from user's declared canonical), last crawl date.
3. If FAIL or NEUTRAL, explain the specific blocker in plain language.1. gsc_list_sitemaps(site) → confirm sitemap is clean
2. gsc_inspect_url(site, new_url) → indexing status
3. If not yet indexed and < 48 hours old, that's normal; tell user.
4. If > 7 days and still not indexed, diagnose (robots, canonical, quality).Use the flexible tool:
gsc_query_search_analytics(
site_url=...,
dimensions=["query", "device"], # or ["page", "country"], etc.
row_limit=50
)GSC API does not return deltas. Run two queries and compute the difference yourself:
1. gsc_query_search_analytics(start_date=T-28, end_date=T-0, dimensions=["query"])
2. gsc_query_search_analytics(start_date=T-56, end_date=T-29, dimensions=["query"])
3. Join on query, compute clicks_delta and position_delta, sort and surface top
3 winners and top 3 losers.sc-domain:defusely.com — Defusely marketing sitehttps://defusely.app/ — Defusely product (URL-prefix property, if configured that way)Always verify the exact format with gsc_list_sites before calling site-specific tools.
end_date = today — the data will be incomplete; use today - 3 days.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.