Pipeworx amplitude

Retrieve and analyze user events, active counts, retention, and profiles in Amplitude with detailed date-range and granularity options.

Security Scan

The skill claims to query Amplitude but its instructions point to an external Pipeworx gateway (pipeworx.io) while declaring no credentials—this mismatch could cause user data to be sent to a third party and is not sufficiently explained.

Purpose & Capability

The skill's purpose is Amplitude analytics, but instead of declaring Amplitude API keys or an official Amplitude endpoint it references a third-party gateway (https://gateway.pipeworx.io/amplitude/mcp). Legitimately querying Amplitude normally requires credentials; those are not requested or explained.

Instruction Scope

SKILL.md defines RPC-like actions (amp_get_events, amp_user_search, etc.) and includes a JSON block pointing the agent to an external MCP server. That directs the agent to send event/identity queries (potentially including PII) to pipeworx.io — the instructions are vague about what data is transmitted, who owns the gateway, or how authentication is handled.

Install Mechanism

No install spec and no code files are present, so nothing is written to disk by the skill itself. This lowers risk from arbitrary installs.

Credentials

No environment variables or credentials are declared despite needing access to Amplitude data. This is inconsistent: either the gateway holds credentials (not disclosed) or the agent must transmit user credentials at runtime — both scenarios require explicit disclosure and justification.

Persistence & Privilege

Skill is not always-enabled and does not request elevated persistence or modifications to other skills or system-wide settings.

Scan Findings in Context

[no-regex-findings] expected: Scanner found no code or regex matches; this is expected because the skill is instruction-only (SKILL.md only). Absence of findings does not imply safety.

What to consider before installing

Before installing, ask the publisher these questions and take these steps: 1) Who operates https://gateway.pipeworx.io and where are requests logged/stored? 2) How does authentication to Amplitude work—does the gateway hold org credentials, or will you be asked to provide them? 3) What exact data will be transmitted to the gateway (events, user identifiers, emails)? Avoid sending PII until you have clear answers. 4) Prefer official integrations that call Amplitude endpoints directly or run in your controlled environment; demand source code or a homepage to verify. 5) If you must test, do so with a non-production Amplitude project and no real user identifiers, and review network logs and privacy policies. If the publisher cannot clearly justify the external gateway and data flows, treat this skill as untrusted.

Amplitude

Amplitude MCP Pack

amp_get_events

Get event counts and breakdowns for a date range (e.g., "2024-01-01" to "2024-01-31"). Returns frequ

amp_get_active_users

Get active user counts by granularity (daily, weekly, or monthly) for a date range. Returns totals a

amp_get_retention

Get user retention metrics for a cohort over time. Returns retention percentages by time period (e.g

amp_user_search

Search for users by ID or property (e.g., email, user_id). Returns matching profiles with properties

amp_get_user_activity

Get recent event activity timeline for a specific user. Returns events with timestamps, properties,

{
  "mcpServers": {
    "amplitude": {
      "url": "https://gateway.pipeworx.io/amplitude/mcp"
    }
  }
}