Mixpanel Analytics

This skill appears to be a straightforward Mixpanel Data Export CLI: it needs Mixpanel service-account credentials or an API secret and will call Mixpanel APIs and print event/profile data (which may include PII). The primary concern is metadata incoherence: the registry lists no required environment variables even though SKILL.md and the script clearly expect MIXPANEL_SERVICE_ACCOUNT_USERNAME, MIXPANEL_SERVICE_ACCOUNT_SECRET or MIXPANEL_API_SECRET and optionally MIXPANEL_PROJECT_ID and MIXPANEL_DATA_REGION. Before installing or enabling autonomous invocation, do the following: (1) Require the publisher/maintainer to update the registry metadata to declare the exact env vars/secrets needed so you can audit them; (2) Review the full scripts/mx.py file (the provided file was truncated in the package listing) to confirm it only contacts mixpanel domains and does not send data to other endpoints or log secrets; (3) Consider running the script in a least-privilege environment and avoid supplying secrets with broad scopes — use service accounts with minimal permissions; (4) Be aware that outputs can include user properties/PII; restrict access to agents and logs accordingly. If the publisher cannot justify the missing metadata or provide the full unobfuscated source, treat the skill as untrusted.