Google Indexing API tool. Use when user wants to submit URLs for Google indexing. Supports two modes: "auto-index" (fetch sitemap, diff against cache, submit...

This skill appears to implement exactly what it claims (submitting sitemap URLs to Google's Indexing API), but there are two things to consider before installing: 1) Metadata mismatch: The registry metadata says no credentials are needed, but the SKILL.md and the script require a Google service-account JSON key (GOOGLE_INDEX_SA_KEY or --sa-key). Treat that as an authoring error and verify the skill's requirements before proceeding. 2) Sensitive key handling: You must provide a Google service-account JSON file. Only supply a key from a service account scoped down to the Indexing API and nothing else; avoid using a high-privilege project owner key. Prefer creating a dedicated service account with the minimum permissions and add only the SA email as an Owner in Search Console as documented. Consider using ephemeral keys or rotating/revoking the key after use. 3) Network behavior: The tool will fetch whatever sitemap URL you provide and will follow redirects. If run on a machine with access to internal networks, a malicious or misconfigured sitemap URL could cause requests to internal hosts. Run in an environment you control, or inspect the sitemap contents before running. 4) Review and isolation: The included script is short and readable; you (or a trusted admin) should review it (it only talks to indexing.googleapis.com and to the provided sitemap URLs). If you proceed, run it in an isolated environment (container or dedicated machine) and ensure Python dependencies installed by uv come from trusted registries. 5) Ask the publisher to fix metadata: Request that the skill owner update registry metadata to declare the required env var (GOOGLE_INDEX_SA_KEY) and document the exact permissions the service account needs. If these precautions are acceptable, the skill's behavior is coherent with its purpose; if you cannot safely supply a minimal service-account key or cannot run it in an isolated environment, do not install or run it.

Type: OpenClaw Skill Name: auto-index Version: 1.0.0 The skill provides a legitimate tool for interacting with the Google Indexing API. It correctly handles Google service account credentials, fetches sitemap URLs using standard HTTP libraries, and manages a local cache in a standard user cache directory. There is no evidence of intentional malicious behavior such as data exfiltration, unauthorized command execution, persistence mechanisms, or prompt injection attempts against the agent. The dependencies are standard and reputable. The script includes basic input validation for the service account key path and error handling for API interactions and sitemap parsing.