The Agent Skills Directory

[SAFE]: The skill implements strong credential security by enforcing private file permissions (0600) and directory permissions (0700) for OAuth secrets and tokens in ga4_auth.py. It also prevents the exposure of sensitive tokens in command-line arguments or terminal history by explicitly rejecting arguments like --access-token or --client-secret.
[SAFE]: The skill follows secure authentication practices for local applications, utilizing a local loopback server (127.0.0.1) for OAuth authorization rather than less secure methods like out-of-band (OOB) code exchange.
[SAFE]: The reporting functionality in ga4_query.py includes robust validation, such as verifying dimensions and metrics against the Google Analytics metadata and compatibility APIs before execution. This prevents malformed requests and ensures data consistency.
[SAFE]: The skill explicitly addresses indirect prompt injection risks in SKILL.md by instructing the agent to treat external report data as untrusted and never as instructions. Data output is properly handled using standard libraries like json and csv to ensure correct escaping.

ga4