The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill manages OAuth authentication tokens by reading from and writing to a hidden directory in the user's home folder (~/.clawdbot/credentials/ga4-tokens.json). Accessing the home directory for secret storage is a sensitive operation that creates persistent storage of credentials outside the project's controlled environment.
[DATA_EXFILTRATION]: Multiple utility scripts (e.g., portfolio-audit.mjs, ga4-scan.ts) save aggregated analytics results, which include sensitive business metrics like sessions and user counts, to the /tmp/ directory. On many multi-user systems, files in /tmp are globally readable, potentially exposing the user's analytics data to other local processes or users.
[PERSISTENCE]: The skill implements a token persistence mechanism by automatically refreshing and saving OAuth tokens to ~/.clawdbot/credentials/ga4-tokens.json. This allows the skill to maintain long-term access to the user's Google account properties across different sessions and executions.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external Google APIs, such as website page titles, event names, and search queries.
Ingestion points: Data enters the context via the GA4 Analytics Data API (reports.ts) and Search Console API (searchConsole.ts).
Boundary markers: The skill does not use explicit delimiters or "ignore instructions" warnings when processing this data.
Capability inventory: The skill has the ability to write files to the local system (storage.ts) and request URL re-indexing or deletion via the Indexing API (indexing.ts).
Sanitization: While filenames are sanitized, the content of the data (e.g., page titles) is not filtered, allowing a malicious actor who controls a monitored website to potentially influence the agent's behavior during summary generation.

ga4-analytics