Mobile App Analytics

PassAudited by VirusTotal on May 11, 2026.

Overview

Type: OpenClaw Skill Name: mobile-app-analytics Version: 1.0.0 The OpenClaw AgentSkills bundle for 'mobile-app-analytics' is benign. The `SKILL.md` clearly defines the skill's purpose, scope, and explicitly states that it does NOT store credentials, access files outside `~/mobile-app-analytics/`, or make requests to undeclared endpoints. All declared external endpoints (Firebase, App Store Connect, Play Console APIs) are legitimate for analytics. Code snippets in `app-store.md`, `firebase.md`, and `play-console.md` are standard API calls, JWT generation, SQL queries, or debugging commands, using placeholders for sensitive tokens, consistent with the skill's security declarations. The `setup.md` and `memory-template.md` guide the agent to store information securely and avoid exposing configuration keys, reinforcing a secure design.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

If you provide platform credentials, the agent may be able to read analytics and app performance data from your Firebase, Apple, or Google accounts.

Why it was flagged

The skill may use credentials for third-party analytics accounts. This is expected for the stated purpose and is disclosed, but those accounts can contain sensitive business analytics data.

Skill content

Queries Firebase, App Store Connect, and Play Console when you provide credentials

Recommendation

Use least-privilege, read-only/reporting credentials where possible, and avoid pasting secrets into local memory files or conversation history unless necessary.

Note

ASI06: Memory and Context Poisoning

What this means

Future sessions may reuse stored app context, goals, and preferences, which could influence later analysis or reveal business strategy if the files are shared.

Why it was flagged

The skill intentionally persists business/app context and activation preferences for future use. The storage is disclosed and scoped, but the retained data may still be sensitive.

Skill content

Create `~/mobile-app-analytics/memory.md` with:
- App name and platforms
- Analytics tools they use
- Key metrics they care about
- Current goals or concerns
- When to activate

Recommendation

Periodically review or delete files under ~/mobile-app-analytics/, keep secrets and PII out of them, and correct outdated metrics or goals.