ClawHub
Back to skill

Security audit

Open GA4

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed read-only Google Analytics helper, but users should treat GA4 credentials and returned analytics data as sensitive.

Install only for GA4 properties you are comfortable sharing with your configured model provider. Grant the credential Viewer access only to needed properties, prefer storing the key as a private file path rather than pasting its JSON into config, consider GA4_PROPERTY_ALLOWLIST, and enable GA4_AUDIT_LOG only if you want local query-history metadata saved.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (6)

Context-Inappropriate Capability

Medium
Confidence
85% confidence
Finding
The declaration explicitly states the skill mirrors Google Application Default Credentials discovery and accepts both service-account keys and authorized-user refresh-token files. That is broader than the user-facing description of simply using a GA4 credential, because it may automatically consume locally available Google credentials from gcloud or environment-configured files without the user explicitly selecting that source. In a skill context, silent discovery of ambient credentials increases the risk of unintended account use and credential-scope confusion.

Vague Triggers

Medium
Confidence
82% confidence
Finding
The trigger phrases are broad everyday language such as 'give me the numbers' or 'set it up', which increases the chance of accidental invocation in unrelated conversations. In this skill, accidental invocation can cause outbound requests to Google APIs, enumerate accessible properties, or expose analytics data into the model context without the user clearly intending to run this specific integration.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
This code persistently writes Google Analytics query metadata to disk, including property IDs, dimensions, metrics, filter fields, sort field, date range, and row counts. While it does not appear to log raw analytics rows or credentials, this metadata can still reveal sensitive business intelligence about what properties are queried and how traffic is being analyzed, and the file provides no access control, redaction, retention, or user-notice safeguards.

Credential Access

High
Category
Privilege Escalation
Content
Read-only is not the same as local-only, so say this plainly if the user asks what the
skill can reach. Every command makes an outbound HTTPS request:

- **Sends** their Google credential to `oauth2.googleapis.com` for an access token, then
  queries `analyticsdata.googleapis.com` and `analyticsadmin.googleapis.com`. The token
  carries one scope, `analytics.readonly`. No fourth host is reachable: `assertAllowedUrl`
  checks every URL before `fetch`, and `redirect: "error"` stops a 302 from leaving the
Confidence
90% confidence
Finding
The skill handles a sensitive Google service-account credential and exchanges it for access tokens, then sends report data back into the conversation context. Even though this is necessary for the integration, it creates real credential- and data-exposure risk if the environment is compromised, if secrets are stored insecurely, or if users do not understand that analytics data leaves the local machine and enters the model provider context.

Self-Modification

High
Category
Rogue Agent
Content
Keeping them out of the command line stops a page title from reaching them, because
  a value in a report cannot become a flag. It does not stop whoever controls the
  environment the skill runs in, and in an agent setup that is not only the person at
  the keyboard: an agent that can edit its own configuration or export a variable
  before invoking the skill is in that set too. What the skill can do about it, and
  does, is refuse to hide it: with redaction off, every report carries a caveat saying
  so and `doctor --json` reports it in `warnings`.
Confidence
83% confidence
Finding
The document explicitly acknowledges that if an agent can edit its own configuration or export environment variables before invoking the skill, it may disable redaction or enable user-identifying dimensions. In an agentic environment, that weakens the skill's privacy guardrails and can lead to exposure of person-level analytics data to the model or downstream systems.

Session Persistence

Medium
Category
Rogue Agent
Content
**Open:** <https://console.cloud.google.com/iam-admin/serviceaccounts/create>

**The steps:** create a service account named `ga4-reader`; skip the "grant this
service account access to project" panel entirely, because a Google Cloud role does
nothing for analytics access; then open its **Keys** tab, **Add key**, **Create new
key**, **JSON**. A file downloads.
Confidence
78% confidence
Finding
The setup flow encourages creation and long-term use of a downloadable service-account JSON key, which is a persistent credential. Long-lived static keys materially increase the blast radius of theft or accidental disclosure, especially because the document also notes users may paste the key contents into local configuration and backups, creating multiple resting locations for the secret.

Static analysis

No suspicious patterns detected.