integrations — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited integrations (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Script location. If your host does not set${CLAUDE_PLUGIN_ROOT}, the scripts are in this plugin'sscripts/folder, next toskills/. Run them with Python 3.10 or newer:python, orpython3wherepythonis not found (macOS, many Linux systems).
Show a complete integration status dashboard — which MCP connectors are currently connected, which are available but not yet configured, and which skills each connector unlocks. This is the first thing users should check after installing the plugin to understand what capabilities are active and what additional connections they can set up.
The user may optionally provide:
connected (only active connectors), available (only not-yet-connected), or all (default)python "${CLAUDE_PLUGIN_ROOT}/scripts/connector-status.py" --action status to get the full status dashboard. This reads the active .mcp.json configuration and checks environment variables for npx connectors to determine which are connected.For each category (Chat, Design, CRM, SEO, Email Marketing, Advertising, Analytics, Social Media, etc.):
access field, show it next to the connector. These are the official ad-platform and CRM servers: meta-ads, google-ads-mcp, amazon-ads-mcp and hubspot (checked 2026-10-04; see CONNECTORS.md). google-ads-mcp is read-only. For the read-write ones, say that writes happen only behind /digital-marketing-pro:launch-ad-campaign's typed approval gate, and that new ad objects are created PAUSED/digital-marketing-pro:connect <name> for setup instructions, or /digital-marketing-pro:add-integration <name> for guided configuration"A structured integration dashboard containing:
/digital-marketing-pro:connect <name> to set up any connector" and "Run /digital-marketing-pro:add-integration for custom MCP servers not in the registry"connector-status.py script directly and formats the output~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.