Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent Supermetrics API helper that uses an API key to retrieve marketing data, with some disclosure and trigger-scoping improvements advisable but no hidden or malicious behavior found.
Install only if you intend to let the agent query Supermetrics-connected marketing accounts. Treat the API key and returned account/report data as sensitive, and prefer invoking it only for explicit Supermetrics or connected marketing-platform reporting tasks.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
from urllib.request import Request, urlopen
BASE_URL = "https://mcp.supermetrics.com"
ENV_FILE = Path.home() / ".openclaw" / "skills" / "supermetrics-openclawd" / ".env"
def _load_env_file() -> dict[str, str]:
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def _load_env_file() -> dict[str, str]:
"""Load variables from .env file."""
env_vars: dict[str, str] = {}
if ENV_FILE.exists():
for line in ENV_FILE.read_text().splitlines():
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def _load_env_file() -> dict[str, str]:
"""Load variables from .env file."""
env_vars: dict[str, str] = {}
if ENV_FILE.exists():
for line in ENV_FILE.read_text().splitlines():
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def _get_api_key() -> str:
"""Get API key from environment or .env file."""
key = os.environ.get("SUPERMETRICS_API_KEY")
if not key:
env_vars = _load_env_file()
The skill declares required environment access and its documented functionality clearly depends on networked API calls, but it does not declare an explicit tool scope such as permissions or allowed-tools. This weakens least-privilege controls and makes it harder for a host system or reviewer to understand and restrict what the skill can access, increasing the risk of unintended external calls or secret exposure.
The skill requires a SUPERMETRICS_API_KEY and is designed to query connected marketing accounts, but the description and usage do not warn that requests send data to an external service or that account metadata and analytics may be retrieved. In a credentialed integration, missing disclosure increases the risk of users invoking the skill without understanding external data handling or the sensitivity of accessible account information.
Several triggers are broad terms like "analytics," "marketing data," and "marketing report," which can cause the skill to activate in situations broader than intended. Over-broad activation can route user requests to a skill that uses external credentials and accesses third-party account data, increasing the chance of unintended data access or disclosure.
The _call_api function sends caller-supplied parameters to https://mcp.supermetrics.com using HTTP POST, which can include account identifiers, selected fields, filters, and date ranges from marketing platforms. The file contains no confirmation prompt, user-facing log, or warning that user or system data will be sent to an external service.
No suspicious patterns detected.