install — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited install (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
appId, the per-site collector URL, and the Publisher UUID all come from the user's WireBoard dashboard. Ask the user to paste their snippet; never template one with placeholder IDs.newTracker, e.g. pipeline-0.collector.wireboard.io, or 127.0.0.1:8080 for local dev). Never mention specific paths like /i or /tp2. The exact request path is an internal detail users do not need to see.wireboard.js. WireBoard is its own product.Two scripts, both loaded from https://static.wireboard.io/:
Two identifiers the user must provide (never invent these):
| Identifier | Format | Where to get it |
|---|---|---|
| Site UID (`appId`) | 8-char ID (e.g. AbCd1234) | Embedded in the user's tracking snippet on their site's Install page |
| Publisher UUID | UUID v4 | Settings, Integrations: wireboard.io/dashboard/settings/integrations. Also embedded in the snippet. |
Follow this in order. Detailed reference for each step is in the linked file.
Ask the user:
Detect their framework by reading package.json, composer.json, Gemfile, nuxt.config.*, astro.config.*, next.config.*, or by listing the project root. Confirm with the user before editing.
If the site already uses Google Tag Manager, mention that they have a choice: install via the official WireBoard GTM template (no code changes, managed entirely from GTM) or install via the code snippet like any other site. Neither is mandatory just because GTM is present. Detect GTM by grepping the codebase for googletagmanager.com/gtm.js or a GTM- container ID, or just ask. If the user picks the GTM path, see gtm.md and skip the rest of this step. If they pick the code path or there is no GTM, continue below.
Ask the user to paste their tracking snippet. Paste it verbatim into the right entry point for their framework.
Also ask: does the site have a cookie consent banner? If yes, the correct pattern is to load the tracker cookieless and upgrade on consent (not the default cookie-mode snippet). See the "Consent banner flow" section in tracking-script.md. If no banner, paste the snippet as-is (default cookie mode) or switch to static cookieless if the site is privacy-first.
Read tracking-script.md for: the snippet anatomy (what each line does), the per-framework install table (Next.js App and Pages Router, Nuxt 3, SvelteKit, Remix, Astro, Vite, Laravel, Rails, Django, plain HTML, WordPress, Wix and Squarespace), and the three cookie modes (default cookie / static cookieless / banner flow with upgradeStorage + revoke).
If the project is a SPA (React, Next.js, Vue, Nuxt, SvelteKit, Remix, or Astro with client-side routing via <ClientRouter /> on Astro 5+ or <ViewTransitions /> on Astro 3-4), the snippet only fires ONE pageview on initial load. Client-side navigations need explicit wiring.
For SPAs, you MUST do BOTH:
<meta name="wireboard-publisher" content="UUID"> tag to <head> (the SPA route wiring reads the UUID from there). Required even if the user does not want custom events.trackPageView on each navigation. Patterns per framework are in spa-routing.md.Skipping either step rejects every client-side pageview with HTTP 400 publisher not found.
If the user chose the GTM template install path in Step 2 AND the site is a SPA, the GTM Initialization tag only fires on full page loads, so client-side navigations are NOT tracked out of the box. Tell the user honestly: either add the <meta> tag and router hook above to the codebase (the template's wireboardSetPublisher call sets the publisher in memory, so window.wireboard('trackPageView', ...) from a router hook will work), or accept session-only pageviews. There is no pure-GTM way to track SPA route changes with the current template.
If the user wants custom event tracking:
<script src="https://static.wireboard.io/events.min.js"></script> to <head>, AFTER the main tracking snippet.<meta name="wireboard-publisher" content="UUID"> if not already present.data-wireboard-event-* HTML attributes. Use for static HTML and templates.window.wireboardEvent({...}) calls. Use for React, Vue, Svelte, and any component that mounts and unmounts dynamically.Full anatomy (fields, value normalization, props rules, the 30/300/2000 limits, reserved keys, PII rules, casing consistency, declarative attribute names, programmatic API signature, framework examples, GTM dataLayer mirror) is in custom-events.md. Read it before writing any event code. The API uses {category, action, label, value, props}, NOT {name, props}.
Walk the user through this check:
newTracker call in their snippet, e.g. pipeline-0.collector.wireboard.io).If anything doesn't work, go to troubleshooting.md. DO NOT improvise debugging steps from general analytics knowledge; the WireBoard-specific failure modes (HTTP 400 publisher gate, the SPA route hook, the meta tag requirement) are documented there.
Load these on demand for the work in each step. Do not copy their content into your reply unless quoting a small block.
tracking-script.md: per-framework install patterns + snippet anatomy + cookieless modegtm.md: install via the official Google Tag Manager template (no code changes, Init + Custom Event tags, dataLayer auto-capture, consent flow)spa-routing.md: client-side route tracking for React, Next, Vue, Nuxt, SvelteKit, Remix, Astro, vanilla History APIcustom-events.md: event anatomy, declarative attributes, programmatic API, value normalization, props rules and limits, casing, framework examples, dataLayer mirrortroubleshooting.md: diagnostic flow when integration isn't working + symptom table@wireboard/api (JS/TS) or wireboard-api (Python) SDKs and the API docs.@wireboard/mcp.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.