Umami Stats

Query Umami Cloud (v2) analytics data via API using an environment-provided API key. Use when agents need website traffic, pages, events, sessions, realtime, reports, or attribution data for analysis, planning, experiments, or monitoring. Includes read-only API querying patterns, endpoint selection guidance, and reusable scripts for flexible endpoint + time-range requests.

Summary of what to check before installing: - Provenance: the skill has no homepage/source repository listed. Prefer skills with a verifiable source or review the included files yourself before use. - Required credential: SKILL.md and the script require UMAMI_API_KEY (and optionally UMAMI_BASE_URL, UMAMI_WEBSITE_ID). The registry metadata incorrectly lists no required env vars — treat that as a red flag. - Principle of least privilege: only provide an API key with the minimum necessary scope (read-only, limited websites) and avoid using an admin or wide-scope key. If Umami supports scoped/read-only keys, create one for this skill. - Base URL caution: the script permits an arbitrary --base-url. Do not let agents or untrusted actors change base_url to an attacker-controlled host (that would send your API key to that host). Prefer the default cloud base URL (https://api.umami.is) unless you host Umami yourself and understand the endpoint. - Review the code: the bundled scripts/umami_query.py is small and readable; scan it yourself (or have someone you trust do so) to confirm there are no hidden network calls or local-file reads beyond what's documented. - Autonomous invocation: the skill may be invoked autonomously by the agent. If you are uncomfortable with that combined with giving the skill an API key, either disable autonomous invocation for this skill or only run it when you explicitly trigger it. If you cannot verify the author or do not want to expose an API key, do not install; alternatively, test with a limited-scope key in an isolated environment first.

Type: OpenClaw Skill Name: umami-stats Version: 1.0.0 The skill bundle is designed for read-only querying of the Umami analytics API. The `SKILL.md` explicitly states a read-only purpose and provides safe usage examples, with no evidence of prompt injection attempts. The `scripts/umami_query.py` script uses standard Python libraries to make HTTP GET requests to a configurable Umami API endpoint, retrieving the API key from environment variables or command-line arguments. It does not access sensitive local files, execute arbitrary commands, or exfiltrate data to unauthorized destinations, aligning entirely with its stated function.