Supalytics - Web Analytics

This skill appears to do what it claims (wrap the Supalytics CLI), but take these precautions before installing or running it: - Verify sources: bun.sh and @supalytics/cli come from public sources — confirm you trust bun.sh and the package registry before running curl | bash or global installs. - Prefer manual installs: instead of piping a remote script to bash, manually review the bun installer or install Bun via your OS package manager if available. Consider installing the CLI in a per-project environment rather than globally. - Confirm prerequisites: the SKILL.md requires Bun but the skill metadata only lists the supalytics binary; ensure Bun is installed and the supalytics binary is present. Examples use jq for JSON parsing — install jq if you need that behavior. - OAuth handling: the doc asks the agent to capture and display the OAuth verification URL and poll for completion. Only proceed if you trust the agent to not exfiltrate the URL or tokens; prefer doing the browser authorization yourself. - Scope and sandboxing: because the instruction set runs remote installers and global package installs, run it in a disposable/sandboxed environment (VM or container) if possible. If the publisher can update the skill to explicitly declare Bun (and jq if intended) in required binaries and avoid recommending curl|bash, that would reduce risk and make the package more coherent.