attribution
When the user wants to figure out which marketing actually drives conversions and revenue, choose or interpret an attribution model, or reconcile conflicting numbers across tools. Also use when the user mentions "attribution," "attribution model," "first-touch vs last-touch," "multi-touch," "whic...
Install this skill
or
85/100
Security score
The attribution skill was audited on Jul 30, 2026 and we found 3 security issues across 1 threat category. Review the findings below before installing.
Categories Tested
Security Issues
medium line 152
Webhook reference
SourceSKILL.md
| 150 | |
| 151 | 1. **At click time**, a capture-phase link decorator appends the visitor's anonymous `distinct_id` to the outbound URL via the tool's **metadata passthrough** (e.g. `?metadata[ph_distinct_id]=<id>`). One document-level listener covers every CTA — no per-link edits. |
| 152 | 2. The third-party tool stores that metadata and returns it in its **webhook**. |
| 153 | 3. Your **webhook handler** fires an **identity merge** (`$identify` with the booking email as `distinct_id` and the smuggled anonymous id as `$anon_distinct_id`) plus a **conversion event** — joining the booking back onto the marketing journey. |
| 154 |
medium line 153
Webhook reference
SourceSKILL.md
| 151 | 1. **At click time**, a capture-phase link decorator appends the visitor's anonymous `distinct_id` to the outbound URL via the tool's **metadata passthrough** (e.g. `?metadata[ph_distinct_id]=<id>`). One document-level listener covers every CTA — no per-link edits. |
| 152 | 2. The third-party tool stores that metadata and returns it in its **webhook**. |
| 153 | 3. Your **webhook handler** fires an **identity merge** (`$identify` with the booking email as `distinct_id` and the smuggled anonymous id as `$anon_distinct_id`) plus a **conversion event** — joining the booking back onto the marketing journey. |
| 154 | |
| 155 | ### Guardrails (do not skip) |
medium line 169
Webhook reference
SourceSKILL.md
| 167 | **The last mile — get it into the CRM** (production refinement from Tessa Kriesel). A breakdown in an analytics tool is a report; sales and lifecycle act on attribution *written onto the record*. Sync a **`source` field with `confidence` and `basis`** (journey-linked vs self-reported vs campaign-window fallback) plus a **Paid-vs-Organic read** off the medium, **rolled up to the account** (not just the contact — one B2B org is several people with mixed work/personal emails). How pipeline/lifecycle then *use* it is **revops**' job. |
| 168 | |
| 169 | The pattern is tool-agnostic: identify + merge exists in PostHog, Segment, Amplitude, and via user-id in GA4; the third-party stitch works with any tool that has a metadata passthrough + webhook. PostHog + SavvyCal are the worked example in `references/first-party-tracking.md`. |
| 170 | |
| 171 | --- |
Scanned on Jul 30, 2026
View Security Dashboard