Mixpanel Analytics

Query Mixpanel product analytics — events, funnels, retention, user profiles, and cohorts via the Mixpanel Data Export API. Use when you need to: (1) Query e...

This skill appears to be a straightforward Mixpanel Data Export CLI: it needs Mixpanel service-account credentials or an API secret and will call Mixpanel APIs and print event/profile data (which may include PII). The primary concern is metadata incoherence: the registry lists no required environment variables even though SKILL.md and the script clearly expect MIXPANEL_SERVICE_ACCOUNT_USERNAME, MIXPANEL_SERVICE_ACCOUNT_SECRET or MIXPANEL_API_SECRET and optionally MIXPANEL_PROJECT_ID and MIXPANEL_DATA_REGION. Before installing or enabling autonomous invocation, do the following: (1) Require the publisher/maintainer to update the registry metadata to declare the exact env vars/secrets needed so you can audit them; (2) Review the full scripts/mx.py file (the provided file was truncated in the package listing) to confirm it only contacts mixpanel domains and does not send data to other endpoints or log secrets; (3) Consider running the script in a least-privilege environment and avoid supplying secrets with broad scopes — use service accounts with minimal permissions; (4) Be aware that outputs can include user properties/PII; restrict access to agents and logs accordingly. If the publisher cannot justify the missing metadata or provide the full unobfuscated source, treat the skill as untrusted.

Type: OpenClaw Skill Name: mixpanel-analytics Version: 1.0.0 The mixpanel-analytics skill is a legitimate tool for querying Mixpanel's Data Export and Engage APIs. The Python script (scripts/mx.py) uses standard libraries to perform authenticated requests to official Mixpanel domains (data.mixpanel.com and mixpanel.com) based on user-provided environment variables. No evidence of data exfiltration to unauthorized endpoints, malicious execution, or prompt injection was found in the code or documentation.