Native Google Analytics

Query Google Analytics 4 (GA4) data directly via the Analytics Data API. Use when you need website analytics like top pages, traffic sources, sessions, users...

This skill appears to be a legitimate GA4 client. Before installing, verify you trust the skill source and keep your Google client secret and refresh token private—anyone with them can obtain access tokens for your account. Use a dedicated Google Cloud project and OAuth credentials you control (preferably restricted to analytics.readonly). Because the skill is script-based, you can inspect the two Python files yourself; if you plan to reuse the refresh token across environments, store it securely (e.g., in a secrets manager) rather than embedding it in shared shells. If you need higher assurance, run the scripts locally (not in a multi-tenant environment) and confirm network traffic goes only to oauth2.googleapis.com and analyticsdata.googleapis.com.

Type: OpenClaw Skill Name: native-google-analytics Version: 0.1.1 The skill is designed to query Google Analytics 4 (GA4) data using the official Analytics Data API. It requires sensitive Google OAuth credentials (Client ID, Client Secret, Refresh Token) and a GA4 Property ID, which are explicitly requested as environment variables. The setup instructions in SKILL.md and README.md guide the user through obtaining these credentials via standard Google Cloud procedures and a `python3 -c` command using `google-auth-oauthlib`. The core script `scripts/ga4_query.py` uses these credentials to obtain an access token and then makes read-only API calls to `analyticsdata.googleapis.com`. There is no evidence of data exfiltration to unauthorized endpoints, arbitrary command execution, persistence mechanisms, or malicious prompt injection attempts against the agent. The input parsing for API filters constructs structured JSON and does not appear to allow for code injection.