analytics-dashboard
Pass
Audited by Gen Agent Trust Hub on Jun 27, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a setup script (
scripts/setup_analytics.py) that usessubprocess.runto install dependencies vianpmorpip3depending on the detected project type. - The script validates the requested analytics provider against a hardcoded list of supported services (PostHog, Mixpanel, Amplitude, Segment) before execution, which effectively prevents arbitrary command injection from user-supplied arguments.
- [SAFE]: The skill automates the configuration of analytics tracking by generating local files and components within the user's project directory. This behavior is consistent with its stated purpose of project setup.
- [SAFE]: All external dependencies installed by the skill (e.g.,
posthog-js,mixpanel-browser,amplitude-analytics) are official packages for well-known and trusted analytics services. - [SAFE]: No suspicious network activity, sensitive data exfiltration (e.g., searching for SSH keys or AWS credentials), or obfuscation techniques were identified across the skill's files.
Audit Metadata