Skills server-side-conversion-tracking
📦
server-side-conversion-tracking
Content revision r1 Medium Risk ⚡ Contains scripts⚙️ External commands🌐 Network access
Build Reliable Server-Side Conversion Tracking
Browser restrictions and cross-domain funnels cause advertising platforms to miss purchases. This skill designs a durable capture, reporting, deduplication, and verification workflow.
Supports: Claude Codex Code(CC)
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "server-side-conversion-tracking" from https://skillstore.io/skills/autonnel-server-side-conversion-tracking.md and its manifest at https://skillstore.io/api/skills/autonnel-server-side-conversion-tracking/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "server-side-conversion-tracking". Facebook reports 62 purchases, while the order database records 100. Only 48 paid orders contain fbclid.
Expected outcome:
- Primary finding: click identifier loss likely occurs before the order record.
- Inspect landing capture, redirects, session persistence, and cross-domain checkout transfer.
- Track daily click identifier coverage and compare it with the paid traffic share.
Using "server-side-conversion-tracking". A browser pixel and server event both report each purchase, but totals nearly doubled after launch.
Expected outcome:
- Primary finding: browser and server events probably use different event identifiers.
- Generate one stable purchase event identifier and send it through both delivery paths.
- Confirm deduplication in the platform debugger before scaling traffic.
Using "server-side-conversion-tracking". Plan server-side purchase reporting for Facebook, TikTok, Google Ads, and Microsoft Advertising.
Expected outcome:
- Capture each platform click identifier and campaign parameters on the first landing request.
- Persist identifiers server-side, carry them across domains, and attach them to the order.
- Queue platform deliveries with normalized customer identifiers, retries, deduplication, and reconciliation checks.
Security Audit
Medium Riskv1 • 8/5/2026 Open versioned report
Most static findings are Markdown syntax and conversion-tracking terminology, not executable code or system reconnaissance. The skill does recommend running Docker Compose from a remote repository and describes collecting and transmitting privacy-sensitive customer data.
1
Files scanned
109
Lines analyzed
1
Review items
0
False positives ignored
Confirmed security concerns (2)
Medium
Privacy-Sensitive Customer Data Workflow
The workflow collects client IP addresses, user agents, click identifiers, and hashed customer identifiers for transmission to advertising platforms. Consent is acknowledged, but retention and access controls are not defined.
The listed fields and intended third-party transmission are explicit. The skill also states that hashed personal information remains personal information.
Medium
Unpinned Remote Container Execution
The setup recommends checking out a release tag and running Docker Compose from a remote repository. Mutable tags and unpinned images can introduce supply-chain changes.
The instructions explicitly combine a remote repository, a release tag, and Docker Compose execution. No immutable commit or container image digest is required.
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Ruby/shell backtick execution
```bash
Lines 101-104 instruct the user to run docker compose up from a downloaded repository. This starts externally defined containers and can execute images or mounts declared by that repository.
Risk Factors
⚡ Contains scripts (1)
⚙️ External commands (12)
🌐 Network access (3)
Audited by: codex
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/autonnel-server-side-conversion-tracking/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/autonnel-server-side-conversion-tracking?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/autonnel-server-side-conversion-tracking?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/autonnel-server-side-conversion-tracking/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/autonnel-server-side-conversion-tracking.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
autonnel. (2026). server-side-conversion-tracking security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/autonnel-server-side-conversion-tracking/audits/1BibTeX citation
@techreport{autonnel-autonnel-server-side-conversion-tracking-2026,
author = {autonnel},
title = {server-side-conversion-tracking security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/autonnel-server-side-conversion-tracking/audits/1},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "server-side-conversion-tracking security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
- name: "autonnel"
date-released: "2026-08-05"
url: "https://skillstore.io/skills/autonnel-server-side-conversion-tracking/audits/1"
identifiers:
- type: other
value: "skillstore:autonnel-server-side-conversion-tracking:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
65
Community
83
Spec Compliance
What You Can Build
Repair Under-Reported Purchases
Trace where campaign identifiers or purchase events disappear, then define fixes and measurable verification checks.
Design a New Tracking Pipeline
Plan capture, persistence, order attachment, queued delivery, and deduplication before paid traffic begins.
Reconcile Platform Reporting
Compare advertising conversions with order records while accounting for attribution windows and different reporting dates.
Try These Prompts
Review My Tracking Setup
Review my current funnel for server-side conversion tracking. Platforms: [platforms]. Funnel steps: [steps]. Domains: [domains]. Identify missing stages and priorities.
Plan Click Identifier Capture
Design click identifier and UTM capture for [funnel]. Explain server-side persistence, cross-domain transfer, order storage, and failure checks.
Specify Conversion Delivery
Create a platform-by-platform delivery specification for [platforms]. Include event fields, identifier normalization, credential needs, queue retries, and browser-server deduplication.
Diagnose Reporting Gaps
Diagnose this reporting gap using [order totals], [platform totals], [click identifier coverage], and [debugger results]. Separate tracking loss from attribution differences.
Best Practices
- Capture campaign identifiers before redirects and persist them in a first-party server session.
- Use one stable purchase event identifier for browser and server events.
- Verify delivery, match quality, click identifier coverage, and order reconciliation after every tracking change.
Avoid
- Do not add only a server event while ignoring identifier capture and order attachment.
- Do not send conversion requests inline with payment or checkout processing.
- Do not treat hashed customer data as anonymous or bypass consent requirements.
Frequently Asked Questions
Does server-side tracking recover every missing conversion?
No. It improves delivery and matching, but consent restrictions, missing identifiers, and attribution rules still affect reported totals.
Why must click identifiers be stored on the order?
Order storage survives session loss, supports retries and backfills, and enables reliable joins between purchases and advertising clicks.
How are duplicate browser and server events prevented?
Both paths must send the same stable event identifier for each purchase. Platform debuggers should confirm successful deduplication.
Should platform totals equal database orders?
No. Attribution windows, view-through credit, click dates, and platform-specific rules create expected differences.
Is hashed customer information still personal data?
Yes. Apply consent, access, retention, deletion, and regional privacy requirements before collecting or transmitting it.
Can this skill configure every advertising account automatically?
No. It provides implementation and verification guidance. Credentials, account permissions, platform settings, and current API requirements need direct validation.