Google Analytics
v1.0.0Google Analytics API integration with managed OAuth. Manage accounts, properties, and data streams (Admin API). Run reports on sessions, users, page views, and conversions (Data API). Use this skill when users want to configure or query Google Analytics. For other third party apps, use the api-gateway skill (https://clawhub.ai/byungkyu/api-gateway).
⭐ 1· 1.8k·6 current·6 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md describes a Google Analytics Admin/Data API integration but routes all requests through Maton (gateway.maton.ai / ctrl.maton.ai / connect.maton.ai) and uses Maton-managed OAuth. That is a reasonable design for a GA integration, but it means the skill depends on Maton as an intermediary rather than calling Google endpoints directly. The registry metadata (required env vars / primary credential) does not declare the MATON_API_KEY required by the instructions — an inconsistency.
Instruction Scope
The runtime instructions are narrowly scoped to listing/creating connections, calling Admin and Data endpoints, and completing OAuth via Maton. They do not instruct reading unrelated local files or system state. However, all API calls and OAuth tokens are proxied through a third party (Maton), so the instructions cause user data and Google OAuth tokens to be sent to Maton rather than Google directly.
Install Mechanism
Instruction-only skill with no install spec and no code files — lowest installation risk because nothing is written to disk by the skill itself. The regex scanner had no artifacts to analyze.
Credentials
The SKILL.md requires an environment variable MATON_API_KEY (Authorization: Bearer $MATON_API_KEY) and mentions Maton account setup, but the registry metadata lists no required env vars or primary credential. Requesting a third‑party API key is proportionate to a gateway-based design, but the metadata omission is an incoherence and the MATON_API_KEY grants Maton ability to act on the user's behalf and access GA data — a non-trivial permission.
Persistence & Privilege
The skill is not marked always:true and does not request elevated platform persistence. It is user-invocable and allows autonomous invocation (platform default). Nothing in the SKILL.md indicates the skill will modify other skills or system-wide agent settings.
What to consider before installing
This skill routes Google Analytics API calls through Maton (gateway.maton.ai) and requires you to provide a MATON_API_KEY and complete OAuth with Maton. Before installing: (1) confirm you trust Maton (review their site, privacy policy, and reputation); (2) understand that Maton will be able to access and manage your GA accounts/properties via OAuth — treat this like granting a third‑party admin/inquiry access; (3) note the registry metadata omitted the MATON_API_KEY requirement — ask the publisher to fix metadata or provide source code; (4) prefer least-privilege credentials and rotate/ revoke keys if you test this; (5) if you prefer not to hand GA access to a proxy service, use a skill that calls Google APIs directly or supply credentials scoped only for read/reporting. If you need higher assurance, request the skill's source or a verifiable homepage and avoid giving production GA accounts until you confirm the vendor.Like a lobster shell, security has layers — review code before you run it.
latestvk976v7t387xpv6be17ee7zfy7x80jgjj
License
MIT-0
Free to use, modify, and redistribute. No attribution required.