ClawHub

Plausible

v1.0.1

Query Plausible Analytics API for traffic stats, referrers, conversions, and custom events.

⭐ 0· 318·1 current·1 all-time
byIván@ivangdavila
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description match the declared behavior: the skill queries Plausible endpoints and only asks for PLAUSIBLE_API_KEY and site_id information. There are no unrelated binaries, services, or credentials requested.
✓
Instruction Scope
SKILL.md instructs the agent to read/write only under ~/plausible/ (memory.md, saved queries) and to send queries to plausible.io or a self-hosted base URL. It explicitly says not to store API keys and not to send other data. There are no instructions to read other system files or unrelated environment variables.
✓
Install Mechanism
This is instruction-only with no install spec and no code files, so nothing is downloaded or written by an installer. That minimizes the attack surface.
✓
Credentials
Only PLAUSIBLE_API_KEY is required, which is appropriate for an API client. No unrelated secrets or multiple credentials are requested. The SKILL.md states the API key is provided from the environment and is sent as a Bearer token to the Plausible API.
✓
Persistence & Privilege
always is false and the skill stores only non-secret configuration and cached query results under ~/plausible/. It does not request system-wide config changes or other skills' credentials.
Assessment
This skill appears coherent and only needs your Plausible API key. Before installing: (1) Provide the key via the PLAUSIBLE_API_KEY environment variable (do not paste it into chat). (2) Confirm you trust Plausible (or your self-hosted instance) because queries and the API key are sent to that endpoint. (3) Review ~/plausible/ after first run to see what the skill saved (site list, preferences, cached results); the skill claims not to store API keys. (4) Prefer using a read-limited or revocable API key if Plausible supports it, and rotate the key if you stop using the skill. (5) Because this is an instruction-only skill, behavior is driven by the agent—ensure the agent runtime environment enforces the intended file and network access policies if you require stricter controls.

Like a lobster shell, security has layers — review code before you run it.

latestvk979q2fb18tvw652axk7he2gjd81vtzx

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

📊 Clawdis
OSLinux · macOS · Windows
EnvPLAUSIBLE_API_KEY

Comments