Google Analytics 4

• Outcome: Pass
• Latest audit: Aug 30, 2026 · 1:16 PM UTC
• Version: 1.3.0

Overview

This is a disclosed read-only Google Analytics reporting skill with expected local OAuth token storage and bounded queries.

Install this only in an isolated Python environment, keep the GA4 client secret and token files private, use the readonly OAuth scope, and revoke the OAuth client/token if you no longer need the skill or suspect the local machine is compromised.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill requires shell execution plus file read/write and environment access to perform OAuth setup and API queries, but it declares no explicit permissions. That mismatch creates a trust and review gap: users or orchestration systems may treat the skill as lower risk than it actually is, while it can access local secrets and write persistent token material.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Setup

Install the dependencies declared in `{baseDir}/requirements.txt` in an isolated Python environment. In Google Cloud, enable the Google Analytics Data API and create a **Desktop app** OAuth client using only `analytics.readonly`.

Store the downloaded client JSON at `~/.config/ga4/client_secret.json` or pass a different protected path with `--client-secrets`. The client and token files must be owned by the current user with mode `0600`; each immediate parent directory must reject group/other access, normally mode `0700`. Never paste a client secret, authorization code, refresh token, or access token into chat or a command argument.

• Confidence: 86% confidence
• Finding: The skill instructs users to create a desktop OAuth client and persist refresh/access credentials locally in token files for future use. Even with readonly scope and restrictive file permissions, long-lived local tokens create session persistence that can be abused by other local processes, compromised accounts, backups, or misconfigured home-directory permissions.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

google-analytics-data>=0.18.0
google-auth>=2.23
google-auth-oauthlib>=1.2

• Confidence: 94% confidence
• Finding: The dependency is specified with only a lower bound, so future installs may resolve to newer major or minor releases with breaking changes or newly introduced malicious/transitively vulnerable packages. While this is a common packaging practice, it weakens build reproducibility and supply-chain control, which can expose the skill to unexpected security regressions over time.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

google-analytics-data>=0.18.0
google-auth>=2.23
google-auth-oauthlib>=1.2

• Confidence: 94% confidence
• Finding: Using an unpinned version for authentication-related libraries increases supply-chain risk because a later resolved version could introduce insecure behavior, breaking API changes, or a compromised release. In this context, the package participates in auth flows, so reproducibility and controlled upgrades are especially important even though the issue is not directly exploitable by itself.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

google-analytics-data>=0.18.0
google-auth>=2.23
google-auth-oauthlib>=1.2

• Confidence: 94% confidence
• Finding: The OAuth library is also unpinned, allowing environment-dependent resolution to newer versions that may contain vulnerable code paths, behavioral changes, or compromised artifacts. Because this skill accesses GA4 data through Google auth/OAuth components, dependency drift in this area is somewhat more sensitive than for a non-auth package, though still generally a low-severity supply-chain hygiene issue.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.