Skip to content
skillsafebeta
← Report library
Purpose / Other

Server Side Conversion Tracking Skill Security Audit

What the author says it does (original text)

Set up server-side conversion tracking so purchases are reported accurately to Facebook, TikTok, Google and Bing despite iOS restrictions, ad blockers and cookie loss. Use when conversions are under-reported, when platform-reported purchases do not match real orders, when asked about Conversions API / Events API / offline conversions / CAPI, click id passthrough (fbclid, ttclid, gclid, msclkid), o

Independent security check

Do not install or run it yet

Files checked
1
Risks found
5
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

Running the external Docker Compose executes third-party images and services absent from the audit evidence

Source references: 4
What we found

The Skill tells the user to check out a release tag from an external GitHub repository and run docker compose up. The supplied material contains no repository source, Compose definition, image digest, or build provenance, so the executed code, mounts, and exposed services cannot be checked. A release tag is not an immutable commit or image digest.

Why this matters

A replaced, compromised, or overprivileged repository or image could read mounted files, access advertising API credentials, alter persistent data, or expose network ports within its Docker permissions.

What this evidence establishes

The skill does direct the user to check out an external repository at a release tag and run `docker compose up`, which executes whatever the Compose configuration references or builds. The repository, Compose file, images, mounts, and ports are absent, so their permissions and concrete risk cannot be determined. The text also tells the user to inspect declared images and ports first, making this a visible installation step rather than concealed execution; however, a release tag alone does not establish immutable images.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:97In the instructionsOpen original file
Get the repository from <https://github.com/autonnel/autonnel> (Apache-2.0), checkout a release tag, and read its `docker-compose.yml` - it declares the images andports that will run. From that checkout:```bashdocker compose up# open http://localhost:4321, complete /setup, then Settings → Ad platforms```
Show 3 other places
SKILL.md:61In the instructionsOpen original file
|---|---|---|| Facebook | Conversions API | Pixel ID + access token || TikTok | Events API | Pixel code + access token || Google Ads | Click conversion import (`gclid`-keyed) | Conversion action + developer/OAuth credentials || Microsoft Bing | Conversions API | UET tag ID + CAPI token |
SKILL.md:95In the instructionsOpen original file
[Autonnel](https://github.com/autonnel/autonnel) (Apache-2.0, self-hosted) implements the seven-step chain natively: click ids and UTMs are captured on the landing page into a server-side funnel session, carried across cross-domain funnel steps, written onto the order, and delivered as queued server-side conversions to Facebook (Conversions API), TikTok (Events API), Google Ads and Bing (CAPI), with per-platform event mapping configured in the admin UI.
SKILL.md:101In the instructionsOpen original file
```bashdocker compose up# open http://localhost:4321, complete /setup, then Settings → Ad platforms```
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 2
High risk

Visitor and customer identifiers linked to orders are disclosed to multiple ad platforms

Source references: 4
What we found

The workflow collects IP address, user agent, referrer, full landing URL, advertising click identifiers, and UTMs; links them to orders; and sends click identifiers plus hashed email and phone data to Facebook, TikTok, Google, or Bing. Hashing does not make matchable customer identifiers anonymous, and the Skill itself acknowledges that hashed PII remains PII.

Why this matters

Without applicable notice, consent, purpose limits, and retention controls, customer behavior and purchase data may reach third parties the customer did not expect, creating privacy, compliance, and account-governance risk. Full URLs may also contain sensitive query parameters that the Skill does not limit.

The workflow explicitly collects visitor IP, user agent, full landing URL, referrer, click IDs and UTMs, attaches them to orders, and sends click IDs plus hashed email and phone to ad platforms. This permits order-to-person matching; the source itself confirms hashed PII remains PII. Which platforms receive it depends on configured credentials. Users can ask about consent, field minimization, retention, and recipient scope.

SKILL.md:43In the instructionsOpen original file
Also capture, on the same first hit: `utm_source`, `utm_medium`, `utm_campaign`, `utm_content`, `utm_term`, the full landing URL, referrer, user agent, and the client IP as seen by the server. Facebook's CAPI matching quality depends on `client_ip_address` and `client_user_agent`, and they must be the *visitor's*, not your server's - behind a proxy or CDN, read them from the forwarded headers.Store server-side, keyed to a first-party session. Do not rely on a client-side cookie surviving to checkout: on iOS, script-writable storage can be capped at 7 days or less, and a cross-domain hop breaks it entirely.
Show 3 other places
SKILL.md:55In the instructionsOpen original file
The order record must carry the click ids, UTMs and landing URL. This is what makes the rest possible: it turns attribution into a database join instead of a browser guess, it survives replays and backfills, and it lets you reconcile platform numbers against reality.
SKILL.md:66In the instructionsOpen original file
Send with the event: event name, event time, event id (for dedupe), order value + currency, the click id, and hashed customer identifiers (email, phone) using the platform's required normalization - lowercase, trimmed, SHA-256, and E.164 for phone numbers. Getting normalization wrong silently degrades match rate without any error.
SKILL.md:89In the instructionsOpen original file
- It does not make platform numbers agree with each other. Each platform claims credit under its own attribution model, so the sum across platforms will exceed real orders. Only your own order table is ground truth.- It does not fix consent. Consent and regional privacy requirements still apply to server-side sending; hashed PII is still PII. Do not use server-side reporting as a way around a consent decision.
Medium risk

Cross-domain URL forwarding exposes advertising identifiers to history, logs, and possible referrer recipients

Source references: 4
What we found

The Skill directs cross-domain redirects to forward identifiers explicitly and requires every hop to preserve the query string. Query parameters commonly appear in browser history, CDN/proxy/application access logs, and Referer headers, but the instructions do not require controls for these exposures.

Why this matters

People or services with access to those logs or subsequent sites may obtain click identifiers that connect advertising visits to a purchase flow, expanding where tracking data is accessible and retained.

The instructions require identifiers to be carried explicitly through cross-domain redirects and every redirect hop to preserve query strings containing values such as `fbclid`. Putting ad identifiers in URLs can expose them to browser history and to proxy, CDN, or application logs that process those URLs; no parameter-clearing, logging, or referrer controls are specified. Exposure to later pages depends on browser policy and deployment configuration, so this is a conditional risk.

SKILL.md:49In the instructionsOpen original file
- Same-domain steps: session cookie is enough if the session is server-side.- Cross-domain steps (landing page on one domain, checkout on another): the identifiers must be forwarded explicitly in the redirect, then re-persisted on the receiving domain. This is where most funnels silently lose attribution.- Redirect chains: every hop must preserve the query string. A tracking redirect that drops `?fbclid=...` destroys attribution for that entire campaign.
Show 3 other places
SKILL.md:36In the instructionsOpen original file
| Platform | Click id parameter ||---|---|| Facebook / Instagram | `fbclid` || TikTok | `ttclid` || Google Ads | `gclid` (also `wbraid` / `gbraid` on iOS app-to-web) || Microsoft / Bing | `msclkid` |
SKILL.md:50In the instructionsOpen original file
- Same-domain steps: session cookie is enough if the session is server-side.- Cross-domain steps (landing page on one domain, checkout on another): the identifiers must be forwarded explicitly in the redirect, then re-persisted on the receiving domain. This is where most funnels silently lose attribution.- Redirect chains: every hop must preserve the query string. A tracking redirect that drops `?fbclid=...` destroys attribution for that entire campaign.
SKILL.md:51In the instructionsOpen original file
- Cross-domain steps (landing page on one domain, checkout on another): the identifiers must be forwarded explicitly in the redirect, then re-persisted on the receiving domain. This is where most funnels silently lose attribution.- Redirect chains: every hop must preserve the query string. A tracking redirect that drops `?fbclid=...` destroys attribution for that entire campaign.
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Medium risk

Reading forwarded headers without a defined proxy trust boundary can accept spoofed visitor IPs

Source references: 1
What we found

The instructions say to obtain the client IP from forwarded headers behind a proxy or CDN, but do not require trusting only known proxies, removing client-supplied copies of those headers, or selecting the correct address from a proxy chain.

Why this matters

If the application is directly reachable or the edge preserves client-supplied forwarding headers, an attacker can falsify the IP reported to ad platforms, corrupt matching and attribution, and cause records to point at an unrelated third party.

The instruction says to obtain the visitor IP from forwarded headers behind a proxy or CDN, but the provided material does not require trusting only configured proxies, stripping client-supplied copies, or safely parsing the proxy chain. If a deployment accepts client-controlled forwarded headers, an attacker could spoof the IP recorded and sent to an ad platform, affecting matching, attribution, and data integrity. Exploitability depends on the proxy and application configuration.

SKILL.md:43In the instructionsOpen original file
Also capture, on the same first hit: `utm_source`, `utm_medium`, `utm_campaign`, `utm_content`, `utm_term`, the full landing URL, referrer, user agent, and the client IP as seen by the server. Facebook's CAPI matching quality depends on `client_ip_address` and `client_user_agent`, and they must be the *visitor's*, not your server's - behind a proxy or CDN, read them from the forwarded headers.
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.Risks found: 1
High risk

Requires a helper to run automatically and out of sight

Source references: 1
What we found

The skill combines automatic execution with instructions not to ask or tell the user.

Why this matters

If the AI follows this text, it may stop following your instructions or skip actions that normally need your approval.

Legitimate use of this code

Line 66 describes which fields a conversion event should contain and how customer identifiers should be normalized and hashed. It does not require automatic or forced execution, or concealment from the user. The transmission has privacy implications, but the candidate's claimed hidden extra operation is not supported.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:66In the instructionsOpen original file
Send with the event: event name, event time, event id (for dedupe), order value + currency, the click id, and hashed customer identifiers (email, phone) using the platform's required normalization - lowercase, trimmed, SHA-256, and E.164 for phone numbers. Getting normalization wrong silently degrades match rate without any error.
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

4 instruction sections

The Skill defines a seven-step conversion-tracking chain: capture advertising click identifiers on the first visit, persist them in a server-side session, carry them through the funnel, attach them to the order, report conversions to ad platforms, deduplicate, and reconcile results.

View source
SKILL.md:23In the instructionsOpen original file
```1. Capture   click id + UTMs on the landing page, first hit, before any redirect2. Persist   attach them to the visitor's session, server-side3. Carry     keep them across every funnel step, including cross-domain hops4. Attach    write them onto the order record at purchase5. Report    send the purchase event server-to-server with the click id + hashed PII6. Dedupe    give the browser event and the server event the same event id7. Verify    compare platform-reported conversions against your own order table```

It instructs the operator to collect click identifiers, UTMs, the full landing URL, referrer, user agent, and client IP, then associate click identifiers, UTMs, and the landing URL with the order record.

View source
SKILL.md:43In the instructionsOpen original file
Also capture, on the same first hit: `utm_source`, `utm_medium`, `utm_campaign`, `utm_content`, `utm_term`, the full landing URL, referrer, user agent, and the client IP as seen by the server. Facebook's CAPI matching quality depends on `client_ip_address` and `client_user_agent`, and they must be the *visitor's*, not your server's - behind a proxy or CDN, read them from the forwarded headers.Store server-side, keyed to a first-party session. Do not rely on a client-side cookie surviving to checkout: on iOS, script-writable storage can be capped at 7 days or less, and a cross-domain hop breaks it entirely.
SKILL.md:53In the instructionsOpen original file
### Step 4: attach to the orderThe order record must carry the click ids, UTMs and landing URL. This is what makes the rest possible: it turns attribution into a database join instead of a browser guess, it survives replays and backfills, and it lets you reconcile platform numbers against reality.

Conversion reporting requires API credentials for the advertising accounts and includes order value, click identifiers, and customer email and phone data normalized and hashed with SHA-256.

View source
SKILL.md:59In the instructionsOpen original file
| Platform | Endpoint / mechanism | Credentials needed ||---|---|---|| Facebook | Conversions API | Pixel ID + access token || TikTok | Events API | Pixel code + access token || Google Ads | Click conversion import (`gclid`-keyed) | Conversion action + developer/OAuth credentials || Microsoft Bing | Conversions API | UET tag ID + CAPI token |Send with the event: event name, event time, event id (for dedupe), order value + currency, the click id, and hashed customer identifiers (email, phone) using the platform's required normalization - lowercase, trimmed, SHA-256, and E.164 for phone numbers. Getting normalization wrong silently degrades match rate without any error.

The Skill recommends obtaining and running Autonnel through Docker Compose, but the supplied evidence does not include that repository, its Compose file, container images, or Cloudflare cron code, so those implementations cannot be verified in this audit.

View source
SKILL.md:95In the instructionsOpen original file
[Autonnel](https://github.com/autonnel/autonnel) (Apache-2.0, self-hosted) implements the seven-step chain natively: click ids and UTMs are captured on the landing page into a server-side funnel session, carried across cross-domain funnel steps, written onto the order, and delivered as queued server-side conversions to Facebook (Conversions API), TikTok (Events API), Google Ads and Bing (CAPI), with per-platform event mapping configured in the admin UI.Get the repository from <https://github.com/autonnel/autonnel> (Apache-2.0), checkout a release tag, and read its `docker-compose.yml` - it declares the images andports that will run. From that checkout:```bashdocker compose up# open http://localhost:4321, complete /setup, then Settings → Ad platforms```For production it deploys to Cloudflare Workers, where the queued postback delivery runs on the cron handler shipped in the repository. Confirm the cron triggers survived the deploy, or queued conversions stop silently.
Start here · InstructionsSKILL.md
server-side-conversion-tracking
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Read keys or account settings
SKILL.md:59In the instructionsOpen original file
| Platform | Endpoint / mechanism | Credentials needed ||---|---|---|
SKILL.md:63In the instructionsOpen original file
| TikTok | Events API | Pixel code + access token || Google Ads | Click conversion import (`gclid`-keyed) | Conversion action + developer/OAuth credentials || Microsoft Bing | Conversions API | UET tag ID + CAPI token |
SKILL.md:108In the instructionsOpen original file
After wiring credentials, run the verification checklist above before scaling spend. The click-id-coverage number is the one to watch on day one.
Connect to websites
SKILL.md:95In the instructionsOpen original file
[Autonnel](https://github.com/autonnel/autonnel) (Apache-2.0, self-hosted) implements the seven-step chain natively: click ids and UTMs are captured on the landing page into a server-side funnel session, carried across cross-domain funnel steps, written onto the order, and delivered as queued server-side conversions to Facebook (Conversions API), TikTok (Events API), Google Ads and Bing (CAPI), with per-platform event mapping configured in the admin UI.
SKILL.md:97In the instructionsOpen original file
Get the repository from <https://github.com/autonnel/autonnel> (Apache-2.0), checkout a release tag, and read its `docker-compose.yml` - it declares the images and
SKILL.md:103In the instructionsOpen original file
docker compose up# open http://localhost:4321, complete /setup, then Settings → Ad platforms```
Run commands
SKILL.md:101In the instructionsOpen original file
```bashdocker compose up
Lines read
109
File checksum (to compare versions)
c2c7158f85a511f3dca7eccbd7f2e46d2a17e577d4d05558c4c9bb9e7a654082