GA4 Analytics

• Analyzed: May 12, 2026, 3:02 AM
• Findings: 1
• Version: 1.2.2
• Hash: ded9ead69ff98bfdaafecda3dd324e5b3aab1b97df13a3c8fa13a3b4fb9779fd
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw AgentSkills bundle for GA4 is benign. It provides Python scripts (`ga4_auth.py`, `ga4_query.py`) to authenticate with and query the Google Analytics Data API. The `SKILL.md` clearly outlines its purpose and required environment variables for Google OAuth credentials. Crucially, the `ga4_query.py` script safely parses user input for filtering (e.g., `--filter 'pagePath=~/blog/'`) by constructing Google API `FilterExpression` objects, preventing shell injection. There is no evidence of data exfiltration to unauthorized endpoints, malicious execution, persistence mechanisms, or prompt injection attempts against the agent in the `SKILL.md`.