ads-attribution — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ads-attribution (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Attribution decay is the silent revenue killer of 2026 — Consent Mode V2 EEA enforcement (Jul 21, 2025), iOS ATT, SKAdNetwork → AdAttributionKit migration, and the death of third-party cookies have moved every advertiser's attribution signal toward modeled, server-side, first-party data. Misaligned attribution windows or unverified Consent Mode setups will mis-attribute 15-40% of conversions and silently waste budget.
actions, Meta CAPI config, Apple Ads / AdAttributionKit registration, MMP dashboard (AppsFlyer / Adjust / Branch / Singular), any sGTM container
ads/references/conversion-tracking.md for the cross-platformtracking baseline
server-side)
plan
registration creates dual attribution with SKAdNetwork (SKAN v1-3)
configured on Apple Ads campaigns where applicable
customization audited; overlapping re-engagement windows used for subscription / re-acquisition campaigns
attribution detail
means heavy reliance on SKAN/AAK + privacy threshold
postbacks; campaign consolidation recommended below 1k installs/week
data) vs Last-Click — confirm setting is intentional, not residue from a pre-2026 migration
override allowed but audit any Last-Click overrides for justification
TikTok, Microsoft are integrated as platforms with consent + auto-tagging
import for the activation event
Advanced Mode behavioral modeling to activate
baseline
user_id + event_id + timestamp+ platform tag for every conversion event
Singular) receives both client-side AND server-side events with shared event_id for deduplication
and Meta (CAPI) within 72h of the conversion event
before send; cross-platform hashing convention consistent
any paid campaigns launched
Campaigns, TikTok (enables Maximize Conversions and ROAS bidding)
revenue events tracked (not just install → registration)
user actions
LinkedIn Matched Audiences, TikTok Customer File for cross-device stitching
~10% uplift on properly-implemented setups)
em, ph, fn, ln, ct,st, zp, external_id) sent server-side to Meta
permitted) included in conversion exports
| Metric | Pass | Warning | Fail |
|---|---|---|---|
| GA4 attribution model | Data-Driven | Last-Click (intentional) | Last-Click (residual) |
| Consent Mode V2 | Advanced + verified | Advanced (unverified) | Basic / Not implemented |
| EMQ (Meta Purchase) | ≥8.0 | 6.0-7.9 | <6.0 |
| Event dedup rate | ≥90% | 70-89% | <70% |
| Server-side / client-side hit ratio | ≥80% | 50-79% | <50% |
| ATT opt-in (iOS) | ≥30% | 15-29% | <15% (heavy SKAN reliance) |
| Offline conversion import latency | <24h | 24-72h | >72h |
| Customer Match list freshness | <7 days | 7-30 days | >30 days |
Attribution Health Score: XX/100 (Grade: X)
iOS (AdAttributionKit + ATT): XX/100 ████████░░ (20%)
Web (GA4 + Ads + CAPI): XX/100 ██████████ (30%)
Consent Mode V2: XX/100 █████████░ (15%)
Server-Side Stitching: XX/100 ████████░░ (20%)
MMP Health (mobile): XX/100 ███████░░░ (10%)
Cross-Device / Customer Match: XX/100 ██████░░░░ (5%)ATTRIBUTION-AUDIT.md: Full surface-by-surface findingswindows + which events)
over-attribution)
to ensure attribution is wired before spend begins
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.