tracking-sync — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited tracking-sync (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill for Step 4 and Step 5 work.
One of:
<artifact-dir>/event-schema.json<artifact-dir>/gtm-config.jsonIf the telemetry consent prompt appears and no prior choice is recorded, stop and follow ../../references/telemetry-consent.md before continuing.
If GTM config does not exist yet:
./event-tracking generate-gtm <artifact-dir>/event-schema.json --measurement-id <G-XXXXXXXXXX>Then sync:
./event-tracking sync <artifact-dir>/gtm-config.jsonIf account/container/workspace IDs are already confirmed, skip interactive selection:
./event-tracking sync <artifact-dir>/gtm-config.json --account-id <account-id> --container-id <container-id> --workspace-id <workspace-id>--force.sync calls Google's official GTM API via interactive OAuth. The consent flow needs outbound HTTP and a local loopback callback on 127.0.0.1; run sync in an environment that permits both.sync with an interactive TTY from the start whenever it may prompt for OAuth consent, account, container, workspace, or new workspace name. Non-interactive invocation will fail at the first prompt.sync only when exact --account-id, --container-id, and --workspace-id values are already confirmed.Produce and share:
<artifact-dir>/gtm-config.json<artifact-dir>/gtm-context.json<artifact-dir>/workflow-state.jsonFor Shopify runs, also expect:
<artifact-dir>/shopify-custom-pixel.js<artifact-dir>/shopify-install.mdStop after sync unless the user explicitly asks for verification.
Default next phase:
./event-tracking preview <artifact-dir>/event-schema.json --context-file <artifact-dir>/gtm-context.json~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.