Ga4 Data Api

Query Google Analytics 4 (GA4) data through the Google Analytics Data API for trends, countries, sources, pages, and conversion analysis. Use when a user wan...

Security Scan

The skill is internally consistent with its stated purpose (querying GA4 via the Data API using OAuth); it installs expected Python deps, stores OAuth client/token in the user's config, and modifies the user's shell RC to persist GA4_PROPERTY_ID.

Purpose & Capability

Name/description match the included code and instructions: the Python script and install helper are designed to query GA4 via OAuth and the Google Analytics Data API. Required actions (installing google-analytics-data libs, storing client JSON, caching tokens) are proportionate to the skill's purpose.

Instruction Scope

Runtime instructions stick to GA4 setup and queries and explicitly prefer OAuth user flow. They instruct running the provided install and query scripts. Minor inconsistency: the install script's final echo message references a slightly different path for ga4_query.py than other docs (likely a copy-paste error); otherwise instructions do not ask for unrelated files or credentials.

Install Mechanism

No platform install spec in registry, but the included install script runs 'python3 -m pip install --user ...' to fetch PyPI packages and copies the provided client secret JSON to ~/.config/openclaw. This is expected for a Python-based GA4 client but does perform network installs from PyPI and writes files under the user's home directory.

Credentials

The skill does not require external credentials in the registry metadata, and the code uses a local client-secret JSON and stores an OAuth token at ~/.config/openclaw/ga4-token.json — this is appropriate for OAuth. The install script also persists GA4_PROPERTY_ID by writing an export to the user's shell rc; this is convenient but is a persistent change the user should expect.

Persistence & Privilege

The skill writes files to ~/.config/openclaw and appends/updates an export GA4_PROPERTY_ID in the user's shell rc (~/.bashrc or ~/.zshrc). It does not set always:true or modify other skills. Writing its own config and caching tokens is normal, but it is persistent and stored locally.

Assessment

This skill appears to do what it says: it uses OAuth to query GA4 and stores the OAuth client JSON and tokens under ~/.config/openclaw. Before installing: review and keep the client-secret JSON private, and be prepared that the installer will (1) install Python packages from PyPI, (2) copy your client JSON into ~/.config/openclaw, and (3) add or update an export GA4_PROPERTY_ID line in your shell rc (~/.bashrc or ~/.zshrc). Confirm you will sign in with the Google account that actually has access to the GA4 property. If you later want to remove access, delete ~/.config/openclaw/ga4-client.json and ga4-token.json and remove the GA4_PROPERTY_ID export from your shell rc; also revoke tokens in Google account security if necessary. Finally, the install script's final printed path to ga4_query.py looks inconsistent with the other docs—verify the script path before running the suggested authorize command.

Use this skill to set up and query GA4 through OAuth user authorization.

Default approach

Prefer OAuth user authorization first.

Use scripts/install_ga4_openclaw.sh + scripts/ga4_query.py for the normal path.

Only suggest service accounts later, when there is a clear need for headless/server-side access.

Hard rules

1. Check account + permission before setup

   • Ask which Google account can actually log into GA and has property/account access.
   • Do not start with service-account setup by default for enterprise/internal data.

2. Be honest about blockers

   • If the user cannot add users, say it is a permission blocker.
   • If the OAuth app is still in Testing, say the account must be added to test users.
   • If the user can see the property but lacks admin controls, say it is an access-level issue instead of pretending the button is hidden.

Setup flow

Step 1 — Verify access model

Ask/confirm:

• Which Google account has GA access?
• Can the user log into that account?
• What is the GA4 Property ID?
• Is Google Analytics Data API already enabled?
• Is there already a Desktop OAuth client JSON?

Step 2 — Install and wire credentials

Run:

bash ~/.openclaw/workspace/skills/ga4-data-api/scripts/install_ga4_openclaw.sh <GA4_PROPERTY_ID> <PATH_TO_CLIENT_SECRET_JSON>

This installs Python deps, copies the OAuth client JSON into ~/.config/openclaw/ga4-client.json, and writes GA4_PROPERTY_ID into shell config.

Step 3 — First authorization

Run:

python3 ~/.openclaw/workspace/skills/ga4-data-api/scripts/ga4_query.py \
  --metrics activeUsers,sessions \
  --dimensions date \
  --start 7daysAgo \
  --end today \
  --pretty

The browser will open. The user must choose the same Google account that actually has GA access.

Successful authorization creates:

• ~/.config/openclaw/ga4-token.json

Step 4 — Query examples

Recent trend:

python3 ~/.openclaw/workspace/skills/ga4-data-api/scripts/ga4_query.py \
  --metrics activeUsers,sessions \
  --dimensions date \
  --start 7daysAgo \
  --end yesterday \
  --pretty

Country split:

python3 ~/.openclaw/workspace/skills/ga4-data-api/scripts/ga4_query.py \
  --metrics activeUsers \
  --dimensions country \
  --start 7daysAgo \
  --end yesterday \
  --limit 50 \
  --pretty

Source split:

python3 ~/.openclaw/workspace/skills/ga4-data-api/scripts/ga4_query.py \
  --metrics sessions \
  --dimensions sessionSourceMedium \
  --start 7daysAgo \
  --end yesterday \
  --limit 50 \
  --pretty

Analysis guidance

For trend questions:

• Prefer full days (end=yesterday) unless the user explicitly wants intraday.
• Call out whether a same-day drop is just partial-day data.

For conversion questions:

• Separate traffic events from true conversion events.
• If key events look too broad, recommend narrowing the event set before drawing product conclusions.

References

• Read references/setup.md when the user needs the shareable setup process.
• Use scripts/ga4_query.py instead of hand-writing fresh GA SDK samples each time.