umami-setup

Add Umami self-hosted analytics to any website with adblocker-proof proxy. Covers: creating the website in Umami, setting up a same-domain proxy (Next.js, As...

This is a how-to guide you will follow manually. Before proceeding: ensure the Umami instance you use is trusted; run the provided curl commands in a secure terminal (they require admin username/password and will return a sensitive bearer token); avoid pasting credentials into third-party or shared consoles; deploy the reverse proxy with HTTPS and limit direct exposure of the Umami backend (bind to localhost or restrict by firewall); verify Host header handling and CORS on your proxy so you don't accidentally forward internal hostnames or auth headers; test changes in a staging environment first and confirm pageviews while using an adblocker. If you prefer automation, consider creating limited-scope API credentials rather than using the Umami admin account where possible.

Type: OpenClaw Skill Name: umami-setup Version: 1.0.0 The skill instructs the agent to execute `curl` commands against user-provided domains (`<UMAMI_HOST>`, `<YOUR_DOMAIN>`) and to parse JSON output using `python3 -c` (SKILL.md). While these actions are part of the skill's stated purpose (Umami setup), they introduce significant vulnerability risks, such as potential Server-Side Request Forgery (SSRF), credential exposure to malicious endpoints, or shell injection if user-controlled input to `python3 -c` is not properly sanitized. There is no evidence of intentional malicious behavior, but the capabilities are high-risk.