google-analytics

SUSPICIOUS: the skill's analytics purpose is coherent, but its trust model is not. It directs users to install an archived, third-party personal MCP server from npm and hand it a Google service-account private key, despite official Google-maintained alternatives existing. That makes this a high security-risk skill due to supply-chain and credential-forwarding concerns, though not confirmed malware.