Matomo Analytics

This skill appears coherent and does what it says, but keep these precautions in mind before installing or using it: - Confirm the Matomo URL you provide is your own self-hosted instance; the skill will send API requests only to that URL. - Do NOT paste your token into chat. Follow the guidance to store the token in an environment variable (e.g., MATOMO_TOKEN) or the system keychain and reference it by name. - Be aware that including token_auth in a query string (the examples use ?token_auth=...) can expose the token in server logs, proxies, or shell history. Use HTTPS and prefer secure storage; if possible avoid pasting tokens into command lines that might be recorded. - Periodically inspect ~/matomo/ (memory.md, reports) to ensure no credentials were accidentally saved in plaintext. - Because this is instruction-only (no code installed), the agent and you are responsible for following the documented rules; if you need stronger guarantees, prefer a skill that includes vetted code or an installable package from a trusted source. - If you share access with others, rotate the token and limit its scope where Matomo supports that. If you want, I can list the exact places the skill will write (files and directories), or suggest safer command patterns for calling Matomo so tokens are less likely to leak.