Security audit

Google Analytics Insights

Security checks across malware telemetry and agentic risk

Overview

This GA4 analytics skill has a plausible purpose, but it asks users to grant an outside service account ongoing read access to their analytics without clearly explaining the trust and privacy implications.

Install only if you are comfortable granting the listed service account read access to your GA4 property. Prefer a version that uses your own Google Cloud service account or OAuth, explains who operates any external account, documents data retention, and provides clear revocation steps.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The setup flow tells users to grant GA4 property access to a hardcoded external service account controlled outside the user's environment, while reassuring them that it is read-only. Even if the assigned GA role is Viewer, this still grants a third party ongoing access to potentially sensitive analytics data and normalizes unnecessary trust in an external identity.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The skill hardcodes an external service-account email and instructs the user to add it to GA4 Property Access Management. For a plain-English analytics assistant, this creates unjustified third-party access to business analytics data and could expose traffic, geography, device, and conversion insights to an outside operator.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The guide instructs users to grant a third-party Google service account direct read access to their GA4 property, but it does not disclose what data will be accessed, how it will be stored, who operates the account, or the privacy and compliance implications. Even with a Viewer role, GA4 data can include sensitive business intelligence and potentially regulated analytics data, so this creates a real data-sharing and trust-boundary risk.

Vague Triggers

Medium

Confidence: 79% confidence
Finding: The skill is advertised as responding to broad natural-language analytics questions without clear invocation boundaries. In an agent environment, this can cause unintended triggering on ordinary conversation and lead to unsolicited access to connected analytics data or execution of related actions.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The phrase 'Or just ask naturally' explicitly encourages ambiguous trigger behavior, increasing the chance that normal discussion about traffic, conversions, or site performance will activate the skill. That ambiguity is risky because it can expose analytics data unexpectedly or cause the agent to prefer this skill over safer or more appropriate handlers.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: Query responses, including analytics breakdowns and raw API response data, are cached to a local JSON file without notice or access controls. On shared systems this can leak sensitive business telemetry to other local users or to later processes that inspect the cache directory.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The skill enables a catch-all natural-language handler that forwards arbitrary user input directly into a command invocation without visible scoping, allowlisting, or intent constraints. In an agent environment, this can cause the skill to activate on broad analytics-related prompts and pass unpredictable text into downstream logic, increasing the risk of unintended tool execution, unsafe query construction, or command/argument injection if the Python handler is not robustly validating input.

VirusTotal

No VirusTotal findings

View on VirusTotal