Pull daily Gumroad product/sales analytics safely (no raw PII persistence by default).

This skill appears to do what it says, but take these precautions before installing or running it: - Verify the credentials file (~/.config/gumroad/credentials.json) exists and contains only the Gumroad access token; keep file permissions restrictive (chmod 600) as recommended. - Be cautious with --store-raw: inspect the raw-output redaction logic and confirm it removes all PII fields you consider sensitive (the script only removes keys 'email','full_name','name','buyer_email'). - The script sends the token as a URL query parameter, which can be captured in logs; if you prefer, run in a controlled environment or modify the script to use an Authorization header if Gumroad supports it. - Note the script respects an optional GUMROAD_CREDENTIALS_FILE env var (not documented in SKILL.md) — if you rely on that, ensure its value points to the intended file. - As with any third-party script, inspect the code yourself and run it in an isolated environment if you have concerns about credential exposure or file writes.

Type: OpenClaw Skill Name: gumroad-analytics Version: 1.0.1 The skill bundle is benign. It fetches Gumroad analytics data, processes it, and stores summaries locally in the designated 'memory' directory. Credentials are read from a specified local file (`~/.config/gumroad/credentials.json`). The `SKILL.md` instructions are clear and do not contain prompt injection attempts. The `fetch_metrics.sh` script uses `curl` to interact with the legitimate Gumroad API (`api.gumroad.com`) and includes a Python script to redact PII (email, name) from raw sales data before optional storage, demonstrating a privacy-conscious design. No evidence of data exfiltration to unauthorized endpoints, persistence mechanisms, or other malicious behaviors was found.