Ga4 Data Api

• Outcome: Review
• Latest audit: Sep 11, 2026 · 9:43 PM UTC
• Version: 0.1.0

Overview

This GA4 skill is purpose-aligned, but its installer has unsafe shell-startup modification and credential-storage risks users should review before installing.

Install only if you are comfortable reviewing or hardening the installer first. Use a trusted GA4 property ID, avoid running it with values supplied by someone else, consider manually storing GA4_PROPERTY_ID outside shell startup files, and restrict permissions on ~/.config/openclaw/ga4-client.json and ga4-token.json.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/install_ga4_openclaw.sh:28

Finding

Persistent Shell Command Injection Through Unsanitized GA4 Property ID

Content

View full analysis

Remediation

View remediation

&2 exit 1 fi ``` - Do not interpolate shell variables into Python source. Pass values as command-line arguments or environment variables: ```bash python3 - "$SHELL_RC" "$PROPERTY_ID" <<'PY' import sys from pathlib import Path rc = Path(sys.argv[1]) property_id = sys.argv[2] PY ``` - Avoid modifying `.bashrc` or `.zshrc` when possible. Store the property ID in a dedicated configuration file with restrictive permissions and load it explicitly. - If a shell assignment must be generated, use a robust shell-escaping mechanism rather than manual quoting. - Write startup-file changes atomically and preserve the original file so the operation can be safely rolled back. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/ga4_query.py:42

Finding

OAuth Credentials Stored Without Explicit Restrictive Permissions

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/install_ga4_openclaw.sh:18

Finding

Unpinned Runtime Dependency Installation

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (7)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill instructs the agent to run local scripts, copy OAuth client secrets into a user config directory, write environment configuration, and perform networked API access, but it declares no explicit tool scope or permissions. This creates an authorization gap: a user or orchestrator cannot reliably constrain file, environment, or network actions, increasing the risk of unintended secret handling, local file modification, or outbound access beyond what was expected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script persists OAuth credentials to a token file on disk via token_path.write_text(creds.to_json()) without any warning, consent prompt, or permission hardening. These tokens can grant ongoing read access to GA4 data if another local user, process, backup system, or misconfigured filesystem can access the file, which is especially relevant because the skill is explicitly designed to access potentially sensitive internal or enterprise analytics data.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/install_ga4_openclaw.sh (reported line 12)May include surrounding context.

sh

PROPERTY_ID="$1"
CLIENT_JSON="$2"
CONFIG_DIR="$HOME/.config/openclaw"
mkdir -p "$CONFIG_DIR"

if [[ ! -f "$CLIENT_JSON" ]]; then
  echo "Client secret JSON not found: $CLIENT_JSON"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script copies an OAuth client secret JSON into a persistent config directory without warning the user or setting restrictive permissions. Even if this file is not as sensitive as an access token, it still contains credential material and may facilitate misuse, accidental sharing, or insecure backup/sync exposure.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The installer persistently modifies the user's shell startup file to set GA4_PROPERTY_ID, which changes future shell behavior outside the immediate install session. While the variable itself is not highly sensitive, silently writing to .bashrc/.zshrc expands the script's scope and creates a persistence mechanism that users may not expect from a GA4 setup helper.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script injects configuration into unrelated shell initialization files rather than keeping settings scoped to the application. This is risky because shell RC files are privileged persistence points for user sessions, and normalizing this behavior in an installer makes future abuse easier and reduces user visibility into what changed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The installer modifies the user's shell startup file without prior warning or consent, creating persistent environment changes that apply to future sessions. Although the exported value is only a property ID, the unsafe pattern is the unannounced persistence into a high-trust file, which can surprise users and be abused in similar scripts for more harmful values.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.