The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses an internal API communication model to interact with the tinyanalytics analytics platform. While it supports custom SQL queries via a POST /query endpoint, the documentation specifies that this is a guarded, read-only ClickHouse interface scoped to the specific site data. It includes explicit instructions never to string-concatenate user input into the SQL generated.
[PROMPT_INJECTION]: The skill includes a specific defensive instruction to treat data retrieved from the API (such as page titles or referrers) as untrusted content, instructing the agent to ignore any directives found within that data.
[DATA_EXFILTRATION]: The skill communicates only with the legitimate vendor origin (https://dash.tinyanalytics.io or a user-defined self-hosted origin). It explicitly forbids sending API keys in URL query strings, requiring the use of secure Authorization headers.
[EXTERNAL_DOWNLOADS]: The skill references an external setup page ($ORIGIN/setup.md) as the authoritative source for API definitions, which is a standard practice for maintaining synchronization with live API versions.

tinyanalytics-insights