gtm-tracking-plan — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited gtm-tracking-plan (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Give it a site URL and get back a complete Google Tag Manager build spec — every tag, trigger, and variable to create, plus the exact dataLayer.push() snippets a developer drops into the site. It's the implementation half of a measurement plan. No account connection required.
Best run after /ga4-measurement-plan — pass the same URL and this skill builds the GTM container to deliver that plan. Run alone, it derives a sensible plan first.
/gtm-tracking-plan example.com — full GTM build spec for the site
If a GA4 measurement plan already exists in the conversation, use its event taxonomy. Otherwise, WebFetch the site, infer the site type and funnel, and derive the event list yourself (the same logic as /ga4-measurement-plan, in brief).
For each event you need: name, when it fires, its parameters, whether it's a key event.
List every variable to create, by type:
(ecommerce, value, currency, transaction_id, lead_source, …)
Page Path, Page URL, plus the relevant ones per trigger
G-XXXXXXX)Present as a table: variable name, type, configuration, used by.
One trigger per distinct firing condition. For each: name, type, and conditions.
event equals purchase,generate_lead, …) — the recommended approach for anything pushed to the dataLayer
site cannot push a dataLayer event
Name them consistently: CE - purchase, Click - CTA button.
List every tag to create. For each: name, type, what fires it, and key fields.
Measurement ID. (Calling out "exactly one" prevents the classic double-count bug.)
parameters mapped from the Data Layer Variables
conversion ID/label placeholders
Use a clear convention: GA4 - Event - purchase, Ads - Conversion - Lead.
This is the developer handoff. For every event that needs site code, give a copy-paste dataLayer.push() snippet with realistic placeholders:
<!-- Fire on the order confirmation page, after the dataLayer is initialized -->
<script>
window.dataLayer = window.dataLayer || [];
dataLayer.push({ ecommerce: null }); // clear the previous ecommerce object
dataLayer.push({
event: "purchase",
ecommerce: {
transaction_id: "{{ORDER_ID}}",
value: {{ORDER_TOTAL}},
currency: "{{CURRENCY}}",
items: [
{ item_id: "{{SKU}}", item_name: "{{NAME}}", price: {{PRICE}}, quantity: {{QTY}} }
]
}
});
</script>Include the snippet for each key event and the most important non-key events. Note the firing location (which page / which DOM event) for each.
Give the build sequence:
parameters populated, and not before consent
Call out the common failure modes: dataLayer pushed after the GTM snippet, stale ecommerce object not cleared, tags firing pre-consent, event-name typos.
Deliver as one document:
GTM Tracking Plan — [site]
Container overview: X tags · X triggers · X variables
1. Variables table
2. Triggers table
3. Tags table
4. dataLayer snippets (per event, with firing location)
5. Build order
6. QA checklistare the most common GTM bug.
scraping the DOM is brittle. Use DOM triggers only when the site can't push.
placeholders and a stated firing location.
regulated regions.
/gtm-audit(requires Cogny MCP).
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.