integrate-context-matic — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited integrate-context-matic (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
When the user asks to integrate a third-party API or implement anything involving an external API or SDK, follow this workflow. Do not rely on your own knowledge for available APIs or their capabilities — always use the context-matic MCP server.
Apply this skill when the user:
#### 1a. Detect the Project's Primary Language
Before checking for guidelines or skills, identify the project's primary programming language by inspecting the workspace:
| File / Pattern | Language |
|---|---|
*.csproj, *.sln | csharp |
package.json with "typescript" dep or .ts files | typescript |
requirements.txt, pyproject.toml, *.py | python |
go.mod, *.go | go |
pom.xml, build.gradle, *.java | java |
Gemfile, *.rb | ruby |
composer.json, *.php | php |
Use the detected language in all subsequent steps wherever language is required.
#### 1b. Check for Existing Guidelines and Skills
Check whether guidelines and skills have already been added for this project by looking for their presence in the workspace.
{language}-conventions is the skill produced by add_skills.{language}-security-guidelines.md and {language}-test-guidelines.md are language-specific guideline files produced by add_guidelines.update-activity-workflow.md is a workflow guideline file produced by add_guidelines (it is not language-specific).Call fetch_api to find available APIs — always start here.
language parameter using the language detected in step 1a.key parameter: pass the API name/key from the user's request (e.g. "paypal", "twilio").fetch_api with that value.key) when there is no exact match.key for the user's requested API before proceeding. This key will be used for all subsequent tool calls related to that API.If the requested API is not in the list:
ask with: language, key (from step 2), and your query.These tools return definitions only — they do not call APIs or generate code.
language, key, and an exact or partial case-sensitive model name as query (e.g. availableBalance, TransactionId).language, key, and an exact or partial case-sensitive method name as query (e.g. createUser, get_account_balance).Call update_activity (with the appropriate milestone) whenever one of these is concretely reached in code or infrastructure — not merely mentioned or planned:
| Milestone | When to pass it |
|---|---|
sdk_setup | SDK package is installed in the project (e.g. npm install, pip install, go get has run and succeeded). |
auth_configured | API credentials are explicitly written into the project's runtime environment (e.g. present in a .env file, secrets manager, or config file) and referenced in actual code. |
first_call_made | First API call code written and executed |
error_encountered | Developer reports a bug, error response, or failing call |
error_resolved | Fix applied and API call confirmed working |
add_guidelines called if guideline files were missing, otherwise skippedadd_skills called if {language}-conventions was missing, otherwise skippedfetch_api called with correct language and key (API name)key identified for the requested API (or user informed if not found)update_activity called only when a milestone is concretely reached in code/infrastructure — never for questions, searches, or tool lookupsupdate_activity called with the appropriate milestone at each integration milestoneask used for integration guidance and code samplesmodel_search / endpoint_search used as needed for SDK detailsfetch_api, do not guess at SDK usage — inform the user that the API is not currently available in this plugin and stop.fetch_api is API discovery, not integration — do not call update_activity before it.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.