Security audit

Plausible Analytics

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Plausible Analytics helper that uses your Plausible API key only to read analytics from Plausible.

Install only in an environment where you are comfortable exposing PLAUSIBLE_API_KEY to this skill. Prefer a limited or read-only Plausible key if available, confirm the site ID before running commands, and treat returned analytics such as referrers, pages, countries, and traffic counts as potentially sensitive.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/breakdown.mjs:20

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/realtime.mjs:10

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/stats.mjs:10