The Agent Skills Directory

[COMMAND_EXECUTION]: The test suite (scripts/test_google_analytics.py) uses subprocess.run to invoke the local Python interpreter and run the CLI script for integration testing. This is standard testing behavior and does not pose a security risk in this context.
[CREDENTIALS_SAFE]: The skill manages authentication securely by looking for OAuth credentials in standard local configuration paths (~/.config/ga4/) or using Google Cloud Application Default Credentials (ADC). It does not contain hardcoded secrets and provides clear guidance on secure authentication setup in references/setup_auth.md.
[EXTERNAL_DOWNLOADS]: The skill communicates with Google's official API endpoints (analyticsadmin.googleapis.com and analyticsdata.googleapis.com) to retrieve website metrics. These interactions are directed at a well-known service and are necessary for the skill's primary function.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external GA4 reports (e.g., page paths and titles). While this is an ingestion surface for untrusted data, the skill uses parameterized SQL queries in scripts/google_analytics.py to prevent SQL injection and stores data in a structured SQLite format, which minimizes the risk of the agent misinterpreting the data as instructions.

google-analytics