ClawHub

Native Google Analytics

v0.1.1

Query Google Analytics 4 (GA4) data directly via the Analytics Data API. Use when you need website analytics like top pages, traffic sources, sessions, users...

⭐ 18· 686·4 current·4 all-time
by@codeninja23
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description (query GA4) match the actual code and required env vars. The scripts implement OAuth and call analyticsdata.googleapis.com; required binaries (python3) and env vars (property id, client id/secret, refresh token) are appropriate for this purpose.
✓
Instruction Scope
SKILL.md only instructs the user to create OAuth credentials, generate a refresh token via a local browser flow, set environment variables, and run the provided scripts. The runtime instructions and scripts only read those env vars and call Google endpoints; they do not reference unrelated system files, other credentials, or external endpoints beyond Google's OAuth and Analytics API.
✓
Install Mechanism
There is no install spec; the skill is instruction-and-script only and requires python3 on PATH. No remote downloads, package installs, or extraction of archives are performed by the skill itself.
✓
Credentials
Requested env vars (GA4_PROPERTY_ID, GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, GOOGLE_REFRESH_TOKEN) are exactly the credentials needed to authenticate to Google and query GA4. The number and type of secrets are proportional to the described functionality. No unrelated secrets or config paths are requested.
✓
Persistence & Privilege
The skill does not request always:true, does not modify other skills or system-wide settings, and does not request persistent platform privileges. It runs on invocation only.
Assessment
This skill appears to be a legitimate GA4 client. Before installing, verify you trust the skill source and keep your Google client secret and refresh token private—anyone with them can obtain access tokens for your account. Use a dedicated Google Cloud project and OAuth credentials you control (preferably restricted to analytics.readonly). Because the skill is script-based, you can inspect the two Python files yourself; if you plan to reuse the refresh token across environments, store it securely (e.g., in a secrets manager) rather than embedding it in shared shells. If you need higher assurance, run the scripts locally (not in a multi-tenant environment) and confirm network traffic goes only to oauth2.googleapis.com and analyticsdata.googleapis.com.

Like a lobster shell, security has layers — review code before you run it.

googlevk9766j458ch3xq0t7bzwcmc85h81m7svgoogle analyticsvk9766j458ch3xq0t7bzwcmc85h81m7svlatestvk975wsppy6k47hbze4s2hqje7n81mfkm

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

Binspython3
EnvGA4_PROPERTY_ID, GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, GOOGLE_REFRESH_TOKEN
Primary envGA4_PROPERTY_ID

Comments