add-integration — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited add-integration (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Guide users through adding a custom MCP server integration to the Digital Marketing Pro plugin. Search for existing MCP packages that provide the desired service connection, configure the server entry in .mcp.json with proper command, arguments, and environment variables, test connectivity to verify the integration works, and document the available tools. Supports both pre-built MCP servers from npm and custom implementations for proprietary APIs or internal tools.
The user must provide (or will be prompted for):
~/.claude-marketing/brands/_active-brand.json for the active slug, then load ~/.claude-marketing/brands/{slug}/profile.json. Check for agency credential profiles at ~/.claude-marketing/credentials/ — if agency mode is active, the new integration may need to be mapped to specific client credential sets. Check for agency SOPs at ~/.claude-marketing/sops/. If no brand exists, ask: "Set up a brand first (/digital-marketing-pro:brand-setup)?" — or proceed with defaults..mcp.json entry — server name (following the plugin's naming convention: lowercase with hyphens), command (npx for npm packages), args array with the package name and any required flags, env object mapping environment variable names to credential references, and a description field summarizing what the integration provides. Show the user the exact JSON block to add.skills/context-engine/custom-mcp-guide.md — project structure, required tool definitions, input/output schemas, authentication handling, and error response patterns. Include a starter implementation skeleton for the specific API the user wants to connect, with placeholder endpoints and authentication flow.SERVICE_API_KEY convention), where to add them (.env file in the project root or system environment variables for CI/CD), and how to reference them in the .mcp.json configuration. For agency setups, explain how to add the credentials to the appropriate credential profile at ~/.claude-marketing/credentials/.A complete integration setup report containing:
.mcp.json — server name, command, args, env, and description — formatted and validated against the plugin's configuration schema~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.