Security audit
Security checks for vulnerabilities and agentic risk
This skill transparently helps add Google Analytics tracking code, with privacy and consent considerations users should still review before deployment.
Before installing, confirm you have authority to add Google Analytics to the site, use the consent option where legally or policy required, and avoid sending personal information, credentials, sensitive search terms, full error details, or unnecessary transaction details as analytics event parameters.
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
- **Measurement ID**: Format `G-XXXXXXXXXX` (required, ask if not provided)
- **--events**: Include custom event tracking helpers
- **--consent**: Include cookie consent integration
- **--debug**: Enable debug mode for development
## Step 1: Detect Project Type
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
Add debug configuration:
// For development, enable debug mode
if (process.env.NODE_ENV === 'development') {
window.gtag('config', 'G-XXXXXXXXXX', {
debug_mode: true,
The skill description says it will add Google Analytics but does not clearly warn up front that it injects third-party tracking scripts and sends visitor and event data to Google. That omission can cause users to deploy surveillance functionality without informed consent or adequate privacy review, especially in regulated environments.
The event helpers encourage tracking clicks, searches, logins, purchases, form interactions, shares, and error details, which can capture sensitive behavioral or transactional information. Because the skill does not pair this guidance with strong user-facing privacy warnings, data-minimization advice, or restrictions on sensitive fields, it increases the risk of collecting personal or regulated data and transmitting it to Google.
No suspicious patterns detected.