ClawHub

Google-analytics-GA4

v1.0.0

Query Google Analytics GA4 properties for realtime and historical user metrics, dimensions, and metadata using the official Data API.

⭐ 1· 91·0 current·0 all-time
bywhao@whosc
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description (GA4 reporting) matches the included files (CLI, helper, tests, optional report). Required dependencies (google-analytics-data, requests optional) are appropriate for the functionality.
ℹ
Instruction Scope
SKILL.md and code confine actions to creating/using a Google service account JSON key, calling the GA4 Data API, and optionally sending notifications (DingTalk) if the user configures webhook env vars. One small surprise: several scripts unconditionally set GOOGLE_APPLICATION_CREDENTIALS to ./ga-credentials.json which can override an existing environment variable — the docs mention both options, but the script behavior may be unexpected to some users.
✓
Install Mechanism
No automatic install/downloads or remote installers; dependencies are standard Python packages listed in requirements.txt. The package is shipped as source files (no opaque external payloads).
ℹ
Credentials
The skill does not request unrelated secrets. It expects a Google service account JSON (GOOGLE_APPLICATION_CREDENTIALS or ga-credentials.json) and may use GA4_PROPERTY_ID or a config.json for property selection. Optional DingTalk webhook env vars are documented — these are reasonable but are unrelated to GA4 data access and should only be set if you intend to use notifications.
✓
Persistence & Privilege
Skill is not force-included (always:false) and does not modify other skills or global agent configuration. It runs on-demand and has no elevated platform privileges.
Assessment
This appears to be a legitimate GA4 reporting skill. Before installing: (1) do not commit real service-account JSON keys to repos; use a Viewer-limited service account; (2) check there is no unexpected ga-credentials.json with secrets in the skill directory (the repo includes an empty ga-credentials.json placeholder); (3) be aware some scripts set GOOGLE_APPLICATION_CREDENTIALS to the local ga-credentials.json which may override your global setting — remove or edit that line if you prefer a different path; (4) only set DINGTALK_WEBHOOK / DINGTALK_SECRET if you want outgoing notifications; and (5) review and run test_connection.py first to confirm permissions and quotas before doing large exports.

Like a lobster shell, security has layers — review code before you run it.

latestvk97enhnpt5myfp3xqethpcdrfn838e88

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments