Google Analytics 4 Analytics

• Outcome: Review
• Latest audit: May 29, 2026 at 9:29 PM UTC
• Version:
  1.0.0

Overview

This GA4 skill has a legitimate purpose, but it relies on an unreviewed local executable and broad auto-activation while using analytics credentials.

Review or obtain the referenced ga4-analytics executable before installing or running this skill. Use only read-only Google Analytics credentials scoped to akku-alle.de's intended GA4 property, and consider disabling always-on activation or narrowing triggers so unrelated analytics requests do not run the command.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger phrase "Analytics Daten" is very broad and can match many unrelated user requests about analytics, increasing the chance that this skill is invoked when the user did not specifically ask for GA4 data for akku-alle.de. In an agent environment, ambiguous auto-routing can cause unintended access to analytics data or execution of the associated shell command in the wrong context.

VirusTotal

65/65 vendors flagged this skill as clean.