Mixpanel

v1.0.1

Query Mixpanel analytics with funnels, retention, segmentation, and event tracking via REST API.

0· 522·5 current·5 all-time
byIván@ivangdavila
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description, required env vars (MP_SERVICE_ACCOUNT, MP_SERVICE_SECRET, MP_PROJECT_ID), required binaries (curl, jq), and the declared local config path (~/mixpanel/) all align with a Mixpanel Query API integration that caches queries locally. The primary credential (MP_SERVICE_SECRET) is appropriate for authentication.
Instruction Scope
SKILL.md stays on-topic: all commands and endpoints target mixpanel.com or data.mixpanel.com, it reads only the declared environment variables, and it directs cached results to ~/mixpanel/. One minor mismatch: the example constructs a Basic auth token using the base64 command (echo ... | base64) but base64 is not listed in required binaries. Otherwise the instructions avoid asking users to paste secrets into chat and state they will not store credentials to disk.
Install Mechanism
Instruction-only skill with no install spec or remote downloads. This minimizes disk-write risk: nothing is fetched or executed at install time by the skill itself.
Credentials
The three required environment variables map directly to Mixpanel service-account authentication and project selection; no unrelated secrets or broad credentials are requested. The declared config path (~/mixpanel/) is proportional for caching queries and saved insights.
Persistence & Privilege
The skill is not force-included (always:false) and does not request system-wide privileges. It stores memory and cached query results in a single user-local directory (~/mixpanel/), which is a reasonable level of persistence for this purpose.
Assessment
This skill appears coherent for querying Mixpanel, but before installing consider the following: 1) The skill requires a Mixpanel service account and secret — treat MP_SERVICE_SECRET as sensitive since it can enable queries and exports; create a least-privilege service account and rotate credentials regularly. 2) The SKILL.md example uses the base64 utility but only lists curl and jq as required binaries — ensure base64 is available in your agent environment or add it to required tools. 3) Cached query results are stored in ~/mixpanel/ — if those results contain PII or sensitive analytics, restrict directory permissions and consider where backups or sync tools might copy that data. 4) The skill uses the raw export endpoint which can return detailed event data; only enable this capability for accounts that are allowed to export raw event data. 5) The skill claims it will not send data outside Mixpanel; confirm the agent runtime you use executes those curl commands locally (and does not proxy them through an external host you do not control). If any of these points are unacceptable (for example, service account secrets you cannot provide or strict data-export restrictions), do not install or limit the service-account permissions before enabling the skill.

Like a lobster shell, security has layers — review code before you run it.

latestvk97288r59p2r4dk38yhbdv0nzx81rb3t

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Runtime requirements

📊 Clawdis
OSLinux · macOS
Binscurl, jq
EnvMP_SERVICE_ACCOUNT, MP_SERVICE_SECRET, MP_PROJECT_ID
Config~/mixpanel/
Primary envMP_SERVICE_SECRET

Comments