Is jdrhyne/ga4 safe?
Yes. jdrhyne/ga4 is safe to install. Oathe's behavioral security audit gave the ga4 skill by jdrhyne a trust score of 87/100 with 3 findings, none critical or high.
https://clawhub.ai/jdrhyne/ga4
Is jdrhyne/ga4 safe to install?
This GA4 analytics skill appears legitimate and professionally implemented, using standard Google Analytics APIs and proper OAuth authentication. The main concerns are around sensitive file access during monitoring setup (likely unrelated to the skill itself) and the inherent security considerations of handling OAuth credentials.
What security issues were found in jdrhyne/ga4?
Category Scores
Findings (3)
MEDIUM Canary File Access During Setup -15 ▶
Monitoring detected access to sensitive canary files including .env, SSH keys, and AWS credentials during the audit setup phase. While this appears to be related to the monitoring system itself rather than the skill, it indicates potential for sensitive file access.
LOW Executable Python Scripts -20 ▶
The skill contains Python scripts that execute when invoked. While this is expected functionality for a GA4 integration, it represents executable code that could potentially be misused.
INFO OAuth Credential Requirements -15 ▶
The skill requires sensitive OAuth credentials for Google Analytics access. Users should ensure these credentials are properly secured and have minimal necessary permissions.
Should I install jdrhyne/ga4?
Oathe's verdict for jdrhyne/ga4 is SAFE with a trust score of 87/100. Recommendation: Install with caution.