Umami Stats

Summary of what to check before installing: - Provenance: the skill has no homepage/source repository listed. Prefer skills with a verifiable source or review the included files yourself before use. - Required credential: SKILL.md and the script require UMAMI_API_KEY (and optionally UMAMI_BASE_URL, UMAMI_WEBSITE_ID). The registry metadata incorrectly lists no required env vars — treat that as a red flag. - Principle of least privilege: only provide an API key with the minimum necessary scope (read-only, limited websites) and avoid using an admin or wide-scope key. If Umami supports scoped/read-only keys, create one for this skill. - Base URL caution: the script permits an arbitrary --base-url. Do not let agents or untrusted actors change base_url to an attacker-controlled host (that would send your API key to that host). Prefer the default cloud base URL (https://api.umami.is) unless you host Umami yourself and understand the endpoint. - Review the code: the bundled scripts/umami_query.py is small and readable; scan it yourself (or have someone you trust do so) to confirm there are no hidden network calls or local-file reads beyond what's documented. - Autonomous invocation: the skill may be invoked autonomously by the agent. If you are uncomfortable with that combined with giving the skill an API key, either disable autonomous invocation for this skill or only run it when you explicitly trigger it. If you cannot verify the author or do not want to expose an API key, do not install; alternatively, test with a limited-scope key in an isolated environment first.