Url Utils

My agents kept treating "this URL parsed" as "this URL is safe." Those are different verdicts. A Cyrillic letter inside paypal.com parses fine and points somewhere else. %2541 survives one decode pass and breaks your dedup. And adding tidy utm tags to a Google Ads link overrides the gclid, which kills cost data in GA4. Nothing errors. You just get wrong numbers on the channel where most of your spend goes. This skill is guidance-only. There is no backend and nothing to 404. Your agent runs all 13 operations itself. What it installs are 22 evidence-backed assets: 8 UTM channel templates, 6 per-platform tracking-param sets, 4 CMS canonical patterns, plus fixtures and a homograph allowlist. The param sets catch the whole click-ID family, not just utm_*. Three scripts turn judgment calls into verdicts. verify-url.mjs FAILs homographs and double-encoding, and passes real domains like muenchen.de. strip-tracking.mjs reports "42/57 URLs cleaned, 3.2 params each" and never strips a param you marked as yours. lint-utm.mjs FAILs any medium outside the GA4 list. That one matters: standard naming measured +29% attribution accuracy (CXL Institute, 2025).