analyticscli-cli
Warn
Audited by Gen Agent Trust Hub on Jul 14, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to automatically modify several user shell profile files to append environment variable exports for tool persistence.
- Affected files:
~/.profile,~/.bashrc,~/.bash_profile,~/.zshrc,~/.zprofile. - Action: Appends
export PATH="$HOME/.local/bin:$HOME/.local/analyticscli-npm/bin:$PATH"to each file. - [PROMPT_INJECTION]: The skill retrieves and processes product analytics and feedback data from an external API, introducing a surface for indirect prompt injection where malicious data could influence agent behavior.
- Ingestion points: Output from
analyticsclicommands likefunnel,timeseries, andfeedback list. - Boundary markers: Absent; instructions do not specify delimiters to separate data from instructions.
- Capability inventory: The agent has the ability to execute shell commands and modify local startup scripts.
- Sanitization: No sanitization or verification of the external data is described.
- [EXTERNAL_DOWNLOADS]: The skill installs software from external registries that is associated with the skill author.
- Package:
@analyticscli/clivia NPM. - Source:
wotaso/analyticscli-skillsrepository via NPX.
Audit Metadata