connect — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited connect (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Script location. If your host does not set${CLAUDE_PLUGIN_ROOT}, the scripts are in this plugin'sscripts/folder, next toskills/. Run them with Python 3.10 or newer:python, orpython3wherepythonis not found (macOS, many Linux systems).
Guide users through connecting a specific MCP integration to the Digital Marketing Pro plugin. Provides platform-specific setup instructions, credential requirements, configuration steps, and verification. This is the user-friendly entry point for adding integrations — it handles the common cases (known connectors with established setup paths) while /digital-marketing-pro:add-integration handles custom or unknown MCP servers.
The user must provide (or will be prompted for):
python "${CLAUDE_PLUGIN_ROOT}/scripts/connector-status.py" --action setup-guide --name <connector> to get the detailed setup guide for the requested connector. If the name doesn't match exactly, search the registry for close matches and suggest the correct name.python "${CLAUDE_PLUGIN_ROOT}/scripts/connector-status.py" --action check --name <connector> to determine if the connector is already configured. If already connected, report that and show which skills it powers — ask if the user wants to verify connectivity or reconfigure.For HTTP connectors (the registry-backed ones: Slack, Canva, Figma, HubSpot, Ahrefs, Similarweb, Klaviyo, Amplitude, Google Calendar, Gmail, and the official ad-platform servers meta-ads, google-ads-mcp, amazon-ads-mcp):
.mcp.json ships (it is gitignored), so a fresh install has zero auto-connecting MCP servers — this is deliberate (it keeps Cowork and multi-tenant installs safe). These HTTP connectors are an opt-in catalog, documented in .mcp.json.connectors-reference..mcp.json.connectors-reference into their own .mcp.json (or adds it via /digital-marketing-pro:add-integration), then restarts the client. HTTP connectors need no API key in the file — once the server is added, Claude prompts for OAuth on first use..mcp.json.connectors-reference into your .mcp.json (or run /digital-marketing-pro:add-integration slack), restart, then run /digital-marketing-pro:send-notification — you'll be prompted to authorize Slack via OAuth.".mcp.json.connectors-reference the same way, but they are not in the connector registry, so /digital-marketing-pro:doctor and connector-status.py will not report on them.Official ad-platform and CRM servers (checked 2026-10-04; see the CONNECTORS.md section "Official ad-platform and CRM MCP servers"): the setup guide returns an access field and a setup_note. Read both to the user:
https://mcp.facebook.com/ads, open beta): read + write, with a business-authenticated Meta login.pipx (Claude Code only), or the user self-hosts it over Streamable HTTP, so the URL has a <...> placeholder.https://mcp.hubspot.com, GA): OAuth 2.1 + PKCE with the user's connector app credentials.For every read-write server, tell the user plainly:
/digital-marketing-pro:launch-ad-campaign's typed approval gate;Never add any of them to the shipped .mcp.json; the user copies the entry into their own config.
/sse URLs use the HTTP+SSE transport that MCP spec 2026-07-28 deprecates; Asana's V1 /sse server was shut down on 11 May 2026. Replicate's catalog entry is flagged because its vendor page still lists only /sse.For npx connectors (Google Ads, Meta, Salesforce, Twilio, etc.):
.mcp.json entry to add (from the setup guide)/digital-marketing-pro:add-integration <name> to configure automatically".mcp.json directly/digital-marketing-pro:add-integration which handles npm package discovery and custom MCP server setupA connector setup guide containing:
.mcp.json, ready to copy/digital-marketing-pro:connect salesforce")/digital-marketing-pro:integrations to see your updated integration dashboard" and relevant skills to tryconnector-status.py script directly and provides platform-specific guidance based on the connector registry~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.