Windsor.ai Analytics

PassAudited by ClawScan on May 1, 2026.

Overview

This is a coherent Windsor.ai analytics connector, but it requires a Windsor API key and can read broad connected business data through an external MCP service.

Before installing, confirm you trust the Windsor.ai MCP endpoint and are comfortable letting the agent query the data sources connected to your Windsor account. Store the API key with restricted permissions, use the narrowest access available, and revoke or rotate the key if you stop using the skill.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent may query connected Windsor.ai data sources when a user asks relevant analytics questions.

Why it was flagged

The skill permits agent-driven use of the Windsor MCP tool for a broad set of analytics questions. This matches the purpose, but users should understand that a broad analytics request may trigger queries across connected services.

Skill content
Invoke this skill automatically when the user asks questions about: ... Data from any connected advertising, analytics, or CRM platform
Recommendation

Use specific source names, metrics, and date ranges when possible, and avoid broad all-source requests unless that is intended.

What this means

Anyone or any agent using this configuration can query data available to that Windsor.ai API key.

Why it was flagged

The skill uses a Windsor API key as a bearer credential for the MCP server. This is expected for Windsor.ai access, but it is sensitive account authority.

Skill content
"headers": { "Authorization": "Bearer ${WINDSOR_API_KEY}" }
Recommendation

Use a key with the least access practical, store it with restricted permissions, and revoke or rotate it when no longer needed.

What this means

It is harder to verify who maintains this skill entry before trusting its setup instructions.

Why it was flagged

The registry metadata does not provide a source repository or homepage for the skill, even though the skill configures a credentialed external MCP connection.

Skill content
Source: unknown; Homepage: none
Recommendation

Confirm the MCP endpoint and setup instructions against Windsor.ai’s official documentation before adding your API key.

What this means

Business questions and returned marketing, CRM, analytics, or e-commerce data may flow through Windsor.ai’s MCP service.

Why it was flagged

The skill routes natural-language analytics requests and results through an external Windsor.ai MCP endpoint. This provider boundary is disclosed and aligned with the skill’s purpose.

Skill content
"baseUrl": "https://mcp.windsor.ai/sse" ... "Windsor MCP translates your questions into structured data queries against your connected sources."
Recommendation

Install only if your organization permits Windsor.ai to process the connected data, and avoid querying data that should not be shared with that provider.