Analytics Stack Stinger

Analytics Stack Stinger

Forge status: stages 1-6 of the seven-stage forge pipeline complete (Topic, Research, Distillation, References, Guides, final Skill/Bee authorship). Stage 7 (Register, pair registration in beekeeper-suit and deploy) has not run yet. Everything below this line is grounded in this pair's PRD, the build plan, and the four raw sources archived in references/research/raw/; every claim traces to one of those or is explicitly labelled as general knowledge or inference.

You are equipping analytics-stack-worker-bee, part of the Website Auditor by Legion Code Inc. plugin. Full scope and acceptance criteria: prd-015-analytics-stack.

Purpose

Score a site's analytics and visitor-identification stack across three leaves of the "Analytics and insight" scoring category (12% of the final grade): foundational analytics coverage (5%), industry-specific analytics (4%), and de-anonymization/visitor-identification tooling where lawful (3%). This Stinger builds on vendor-inventory-worker-bee's third-party census rather than re-detecting vendors from scratch, and it flags legal-gray-area de-anonymization findings distinctly instead of rendering a compliance verdict.

When to use this skill

• Wave W5 of every audit run, after 01-recon/vendor-inventory.md and 02-positioning/ both exist.
• Any standalone request specifically about analytics coverage, tag-management-layer composition, or visitor-identification/de-anonymization tooling on an externally-audited site.
• Classifying whether a vendor already surfaced by vendor-inventory-worker-bee belongs in this Stinger's scope versus web-security-posture-worker-bee's or stays purely with vendor-inventory-worker-bee (content-injection-only vendors).

When not to use this skill

• Before 01-recon/vendor-inventory.md or 02-positioning/ exist. This Stinger reads both as inputs and does not re-run vendor detection itself.
• To render a legal/compliance verdict on de-anonymization tooling. That is explicitly out of scope, see guides/04-deanonymization-and-jurisdiction.md.
• To score a write-capable content-injection vendor (e.g. a Search Atlas OTTO Pixel-class tool). That class is owned by vendor-inventory-worker-bee, this Stinger only cross-references it.
• For an internal codebase's own analytics instrumentation review. This Stinger assesses a live, externally-audited site with no source access; that is a different posture from a repo-improvement task.

Procedure

1. Load 01-recon/vendor-inventory.md and 02-positioning/.
2. Classify every analytics-relevant vendor into foundational, industry-specific, de-anonymization, or out-of-scope, using references/templates/vendor-classification-table.md's tiered signatures and references/scripts/analytics-vendor-classify.py as a spot-check.
3. Cross-check the tag-management layer (guides/05-tag-manager-and-injection-cross-check.md) before finalizing scores, GTM is commonly the delivery mechanism for what this Stinger scores.
4. Score each of the three leaves on the plugin-wide zero-to-six scale, every score with a numeric value, an evidence pointer, and a one-line justification.
5. Flag (never adjudicate) any de-anonymization finding's jurisdiction question, per guides/04-deanonymization-and-jurisdiction.md.
6. Log rejected/reframed candidates to the run's verification log.
7. Write 08-analytics/analytics-findings.md from references/templates/analytics-findings-template.md, per guides/06-report-format.md.

Full step-by-step detail lives in guides/01-audit-procedure.md, read it first on every invocation.

References map

Load on demand; do not read everything up front.

Quality bar

A pass through this Stinger is done when: guides/01-audit-procedure.md ran in order, every factual claim used traces to references/research/raw/ or is explicitly labelled Tier B/general knowledge or [subjective], every score has all three mandatory fields (value, evidence pointer, justification), any de-anonymization finding is flagged rather than adjudicated, rejected/reframed candidates are logged, and 08-analytics/analytics-findings.md was written per guides/06-report-format.md.

Related bees and stingers

• analytics-stack-worker-bee - this Stinger's paired Bee.
• vendor-inventory-stinger - upstream census this Stinger reads (01-recon/vendor-inventory.md); do not duplicate its detection work.
• icp-positioning-stinger - upstream niche/ICP determination (02-positioning/) this Stinger's industry-specific leaf depends on.
• web-security-posture-stinger - owns the broader security/consent posture read; consult when a de-anonymization or tag-manager finding raises a security-adjacent question this Stinger doesn't adjudicate.
• audit-scoring-stinger - consumes this Stinger's three leaf scores into the "Analytics and insight" category rollup (12% of the final grade).

Critical Directive

• You must read all files and context contained within your skill.
• In the event your core knowledge does not provide sufficient guidance you must make every attempt to search the internet, related knowledge base documentation files, and other available resources to supplement your knowledge prior to proceeding with your task.
• Additional related skills can be found here:
  • analytics-stack-worker-bee - this Stinger's paired Bee.
  • vendor-inventory-stinger - upstream third-party census; read its output before running this Stinger's classification pass.
  • web-security-posture-stinger - consult for the broader security/consent posture a de-anonymization finding may touch.

Ship Gate decision

Does not apply to a per-run audit. This Stinger's output is a set of findings written into the customer's audit workspace (08-analytics/analytics-findings.md), not a code change to this plugin's own repository, so the security-stinger, quality-stinger, github-repo-health-stinger Ship Gate defined for repo-improvement Bees is not triggered by running an audit. The Ship Gate does apply, per the build plan's Question 22, before any change to this plugin's own source (this file, the paired Bee, shared scripts) is committed and pushed, that is a plugin-development-time gate, not an audit-run-time gate. Do not conflate the two.