Plausible Analytics Agent
v1.0.0Track pageviews and custom events via the Plausible Events API, and query stats (top pages, top sources, countries, realtime visitors). Use when you need to...
⭐ 0· 86·0 current·0 all-time
by@kryzl19
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name and description match the scripts and behavior: the scripts call Plausible Events and Stats APIs and require PLAUSIBLE_SITE_DOMAIN and PLAUSIBLE_API_KEY. Minor inconsistency: the skill bundle does not declare required binaries, but the scripts use curl and jq — these should be documented as required.
Instruction Scope
SKILL.md and the scripts limit actions to building and sending requests to the Plausible base URL (default plausible.io) and printing JSON. They read only the declared env vars (plus the optional PLAUSIBLE_BASE_URL). No unrelated filesystem reads, local secrets, or external endpoints are hard-coded. Note: PLAUSIBLE_BASE_URL is user-configurable, so if set to an arbitrary URL it would direct events/stats to that host (this is expected but should be chosen carefully).
Install Mechanism
No install spec or remote downloads are present; this is an instruction-only skill with included shell scripts. No archives or external installers are fetched, which is low-risk.
Credentials
The skill requires PLAUSIBLE_SITE_DOMAIN and PLAUSIBLE_API_KEY which are appropriate for Plausible Stats calls. PLAUSIBLE_BASE_URL is used but optional and not listed in required env vars — that's acceptable but could be documented. The API key is used only in Authorization headers for stats/realtime/top-pages endpoints; the Events API is intentionally used unauthenticated per Plausible design.
Persistence & Privilege
always:false (default) and the skill does not request to modify other skills or system-wide settings. It does not persist credentials or install background services.
Assessment
This skill appears to do exactly what it says: call Plausible's Events and Stats APIs. Before installing, make sure: 1) you provide a Plausible API key with minimal required scope and rotate it regularly; 2) PLAUSIBLE_BASE_URL is set only to your Plausible instance or plausible.io (don't point it at unknown hosts, or events/stats could be sent elsewhere); 3) the agent environment has curl and jq available (the scripts use them but the bundle doesn't declare them); and 4) avoid including PII in custom event props since those are sent to the configured endpoint. If any of these are unacceptable, don't enable the skill or run the scripts in a controlled environment first.Like a lobster shell, security has layers — review code before you run it.
analyticsvk974kr59hd3ap9mk9xbh2axyxn83j1fnlatestvk974kr59hd3ap9mk9xbh2axyxn83j1fnplausiblevk974kr59hd3ap9mk9xbh2axyxn83j1fnprivacyvk974kr59hd3ap9mk9xbh2axyxn83j1fntrackingvk974kr59hd3ap9mk9xbh2axyxn83j1fn
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📊 Clawdis
EnvPLAUSIBLE_SITE_DOMAIN, PLAUSIBLE_API_KEY