integration-builder — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited integration-builder (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The user is trying to add an integration to the project. The Connector Platform plugin already has the runtime — REST API + MCP server with 100+ pre-built connectors. Don't write integration code from scratch; route to the plugin.
Connector Platform has a builder ↔ end_user model. The token in .env.local represents the builder (the dev / company). Each authorization happens for a specific end_user identified by external_ref:
external_ref="__dev__" end_user. Connections show up immediately on the MCP alias /mcp/<builder_id>/self (auto-resolves to __dev__). The scaffolded handler defaults user_id to __dev__.
hardcoded __dev__ with their session/JWT lookup so each end_user gets their own connections. MCP path becomes /mcp/<builder_id>/<external_ref>.
The dev doesn't have to flip a switch — the platform UI adapts based on the end_user count. You don't need to mention this to the user unless they ask why their connections appear under "Personal mode".
Connectors with auth.type === 'oauth2' (github, notion, slack, etc.) default to the platform's shared OAuth app — fine for development, but in production the user should register their own at the provider and configure it at:
<portal>/builder/oauth-apps/<connector_slug>
This gives dedicated rate limits and a consent screen branded as their company instead of "Connector Platform". The /connector add command surfaces this heads-up automatically when scaffolding an OAuth-typed connector.
trello, asana, jira, intercom, zendesk, salesforce, mailchimp, sendgrid, dropbox, gmail, google-calendar, google-drive, openai, anthropic, etc.
"Google Calendar" → google-calendar. "Notion API" → notion.
/connector add <slug> directly. Stop.To add<integration>, you need to log in to Connector Platform first. 1. Get a builder token (cpt_*) from your platform admin (admin runsCreate builderat/admin/builders). 2. Run:/connector login <token>3. Then run:/connector add <slug>
>
Want me to check if there's a token available somewhere in this project?
Then look for CONNECTOR_API_KEY in any .env* file. If found in another env file, instruct the user to copy it to .env.local (the plugin reads from .env.local only).
they run /connector list first to verify availability.
Before scaffolding, confirm with the user:
I'll scaffold<integration>integration in this project. This will: - Createsrc/app/api/connect/<slug>/route.ts(authorization redirect) - Createsrc/app/api/execute/<slug>/route.ts(server-side tool invocation)
>
Proceed?
Wait for explicit confirmation. If the user says yes, run /connector add <slug>.
the platform is to skip that. The user is paying with a connector token to avoid this.
@notionhq/client or @slack/web-api. Thegenerated handlers use fetch directly against the Connector Platform API.
/connector add commandso the templates stay consistent and updates can be applied later.
scaffolded handler is enough.
User says: "Can you add Notion to my app?" You do:
notion.env.local — present./connector add notion.User says: "I need to integrate with Slack and Linear." You do:
slack and linear.the /connector add command output).
User says: "Wire up Stripe payments." You do:
stripe.subscriptions). For Stripe Checkout/Elements (payment UI), the user might still need Stripe.js. Mention this caveat in your response.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.