Supalytics - Web Analytics

Query web analytics data using the Supalytics CLI. Use when the user wants to check pageviews, visitors, top pages, traffic sources, referrers, countries, revenue metrics, conversions, funnels, events, or realtime visitors.

This skill appears to do what it claims (wrap the Supalytics CLI), but take these precautions before installing or running it: - Verify sources: bun.sh and @supalytics/cli come from public sources — confirm you trust bun.sh and the package registry before running curl | bash or global installs. - Prefer manual installs: instead of piping a remote script to bash, manually review the bun installer or install Bun via your OS package manager if available. Consider installing the CLI in a per-project environment rather than globally. - Confirm prerequisites: the SKILL.md requires Bun but the skill metadata only lists the supalytics binary; ensure Bun is installed and the supalytics binary is present. Examples use jq for JSON parsing — install jq if you need that behavior. - OAuth handling: the doc asks the agent to capture and display the OAuth verification URL and poll for completion. Only proceed if you trust the agent to not exfiltrate the URL or tokens; prefer doing the browser authorization yourself. - Scope and sandboxing: because the instruction set runs remote installers and global package installs, run it in a disposable/sandboxed environment (VM or container) if possible. If the publisher can update the skill to explicitly declare Bun (and jq if intended) in required binaries and avoid recommending curl|bash, that would reduce risk and make the package more coherent.

Type: OpenClaw Skill Name: supalytics Version: 1.0.1 The skill is classified as suspicious primarily due to instructions in `SKILL.md` that require the AI agent to execute commands with elevated privileges. Specifically, it instructs the agent to run `sudo ln -sf ~/.bun/bin/bun /usr/local/bin/bun` and `sudo ln -sf ~/.bun/bin/supalytics /usr/local/bin/supalytics`. While the stated purpose is to make the CLI accessible, granting `sudo` access to an AI agent for system-wide path modification is a significant security risk, as it provides broad permissions. Additionally, the installation process involves `curl -fsSL https://bun.sh/install | bash`, which executes a remote script, posing a supply chain risk.