Google Analytics

AdvisoryAudited by Static analysis on May 1, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If used incorrectly, the agent could change or delete analytics configuration that affects data collection.

Why it was flagged

The skill exposes high-impact Google Analytics administration operations, but the artifact discloses the risk and requires explicit approval for writes.

Skill content
Admin API (write-capable — can create, update, and delete accounts, properties, and data streams) ... All Admin API write operations require explicit user approval with specific resource identifiers before execution.
Recommendation

Prefer the Data API for reports, and approve Admin API writes only when you have checked the exact account, property, stream, and intended change.

What this means

Anyone or any agent with the API key and authorized connection could access the connected Google Analytics resources within the granted scope.

Why it was flagged

The skill depends on a Maton API key and delegated Google OAuth access, which is expected for the integration but grants access to Google Analytics data and admin functions.

Skill content
All requests require the Maton API key in the Authorization header ... Maton proxies requests ... and automatically injects your OAuth token.
Recommendation

Store MATON_API_KEY securely, grant only the connections you need, and revoke unused Google Analytics connections.

What this means

Google Analytics report data and admin requests may transit the Maton service rather than going directly from your environment to Google.

Why it was flagged

Requests and responses pass through a third-party API gateway. This is disclosed and central to the managed OAuth design, but it is still a sensitive data boundary.

Skill content
Maton proxies requests to `analyticsadmin.googleapis.com` and `analyticsdata.googleapis.com` and automatically injects your OAuth token.
Recommendation

Use this skill only if you trust Maton for the connected Google Analytics account and understand its OAuth connection model.