configure-analytics — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited configure-analytics (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Repeatable skill for setting up Plausible, PostHog, and GA4 analytics keys in both local .env and Railway production environment variables.
Plausible API key:
PostHog project API key:
phc_)GA4 Measurement ID:
Write/update repo/.env with:
PLAUSIBLE_API_KEY=<key>
PLAUSIBLE_SITE_ID=thumbgate-production.up.railway.app
POSTHOG_API_KEY=<phc_key>
THUMBGATE_GA_MEASUREMENT_ID=<G-ID or leave commented>Option A — Railway CLI or GitHub deploy variables (preferred):
gh secret list --repo IgorGanapolsky/ThumbGate
gh variable list --repo IgorGanapolsky/ThumbGateIf Railway CLI auth works, set variables with railway variables set. If Railway CLI reports invalid_grant, use the GitHub PR/deploy path and the Railway dashboard in Chrome. Do not direct-push to main; use a focused branch, PR, required checks, and branch-protected merge.
Option B — Chrome (if MCP not authenticated):
# Local: run Plausible poller
npm run social:poll:plausible
# Production: check instrumentation scripts and health
curl -fsS https://thumbgate.ai/health
curl -fsS https://thumbgate.ai/checkout/pro | grep -E 'plausible|posthog|G-[A-Z0-9]+'thumbgate-production.up.railway.appTHUMBGATE_GA_MEASUREMENT_ID when present; do not assume the dashboard is export-ready without provider credentials.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.