syndicate-merchant-onboard — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited syndicate-merchant-onboard (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
When a merchant asks (or an orchestrating agent decides) to set up affiliate tracking on Syndicate Links without touching the dashboard.
business_name (required) — the merchant's company namedescription (required) — one-line description of what they sellurl (required) — storefront or primary product URLemail (required) — contact email for the merchant accountcommission_pct (optional, default "10.00") — commission rate as a string percentproducts (optional) — array of {name, url, price, external_id?}. Default: one placeholder pointing at url.{
"merchant_id": "m_...",
"api_key": "mk_live_...",
"program_id": "p_...",
"product_ids": ["pr_..."],
"tracking_links": [{"tracking_code": "...", "click_url": "https://api.syndicatelinks.co/click/..."}],
"wall_clock_seconds": 8.3
}POST /merchant/register with company + email + password → get merchant_id and api_key. No CAPTCHA, no verification gate.POST /merchant/programs with name, commission_pct, description.POST /merchant/products with program_id, name, url, price, optional external_id.POST /merchant/test-links with program_id + product_id → {code, clickUrl}.POST /merchant/webhooks for conversion/payout events.POST /merchant/conversions with tracking_code + amount_cents.Python SDK: https://github.com/syndicate-links/syndicate-links/blob/master/examples/setup_agent.py
429 → back off with exponential jitter; plan limits are generous (see https://syndicatelinks.co/pricing)400 on register with "slug already exists" → retry with a suffixed business name or let the server auto-suffix422 on product create → verify program_id ownership and that price is a decimal stringReturned api_key is wildcard-scoped (["*"]) by default. For narrower automation, immediately mint a scoped key: POST /merchant/api-keys {"name":"automation","scopes":["conversions:write","analytics:read"]} and discard the initial wildcard key.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.