Skip to content
skillsafebeta
← Report library
Purpose / Other

Launch Skill Security Audit

What the author says it does (original text)

When the user wants to plan a product launch, feature announcement, or release strategy. Also use when the user mentions 'launch,' 'Product Hunt,' 'feature release,' 'announcement,' 'go-to-market,' 'beta launch,' 'early access,' 'waitlist,' 'product update,' 'how do I launch this,' 'launch checklist,' 'GTM plan,' or 'we're about to ship.' Use this whenever someone is preparing to release something

Independent security check

Security risks found

Files checked
2
Risks found
3
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 2
Medium risk

The advice to “leak” product details may expose confidential material

Source references: 1
What we found

The early-access phase explicitly recommends leaking screenshots, feature GIFs, and demos, without requiring removal of customer data, internal URLs, secrets, unreleased pricing, or other sensitive information, and without an approval gate.

Why this matters

If internal assets are used directly, unreleased features, customer information, or business secrets could become public and may remain in reposts or caches after removal.

This is actionable launch guidance, not merely a case study: it recommends releasing screenshots, feature GIFs, and demos during early access. If those assets contain real customer data, internal URLs, credentials, unannounced commercial details, or unapproved material, publication could expose data or undermine launch decisions. The shown text does not require redaction or approval. A user could require asset sanitization, test-data substitution, and an authorization review.

SKILL.md:174In the instructionsOpen original file
### Phase 4: Early Access LaunchShift from small-scale testing to controlled expansion.**Actions:**- Leak product details: screenshots, feature GIFs, demos- Gather quantitative usage data and qualitative feedback- Run user research with engaged users (incentivize with credits)- Optionally run product/market fit survey to refine messaging
Medium risk

Contact and usage data collection lacks privacy and consent safeguards

Source references: 4
What we found

The plan calls for email capture, quantitative usage data, and analytics tracking but does not require data minimization, notice and consent, retention limits, unsubscribe handling, or access controls.

Why this matters

A careless rollout could collect contact or behavioral data beyond users’ expectations, increasing privacy complaints, regulatory exposure, and the impact of a data breach.

The Skill actively recommends an early-access signup form, quantitative usage collection, and analytics tracking, which may process email addresses and product-behavior data. The shown workflow does not mention notice and consent, data minimization, retention, opt-out, or access controls. Actual risk depends on the fields, analytics provider, jurisdiction, and existing privacy program; a user could require those constraints to be defined before implementation.

SKILL.md:150In the instructionsOpen original file
**Actions:**- Create landing page with early access signup form- Announce the product exists- Invite users individually to start testing- MVP should be working in production (even if still evolving)
Show 3 other places
SKILL.md:177In the instructionsOpen original file
**Actions:**- Leak product details: screenshots, feature GIFs, demos- Gather quantitative usage data and qualitative feedback- Run user research with engaged users (incentivize with credits)- Optionally run product/market fit survey to refine messaging
SKILL.md:330In the instructionsOpen original file
### Pre-Launch- [ ] Landing page with clear value proposition- [ ] Email capture / waitlist signup- [ ] Early access list built- [ ] Owned channels established (email, blog, community)- [ ] Rented channel presence (social profiles optimized)- [ ] Borrowed channel opportunities identified (podcasts, influencers)- [ ] Product Hunt listing prepared (if using)- [ ] Launch assets created (screenshots, demo video, GIFs)- [ ] Onboarding flow ready- [ ] Analytics/tracking in place
SKILL.md:338In the instructionsOpen original file
- [ ] Product Hunt listing prepared (if using)- [ ] Launch assets created (screenshots, demo video, GIFs)- [ ] Onboarding flow ready- [ ] Analytics/tracking in place
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
Medium risk

Incentivized promotion lacks disclosure, terms, and authorization checks

Source references: 2
What we found

The Skill recommends influencer partnerships, free products, and affiliate commissions without prompting for commercial-disclosure rules, commission terms, limits on brand claims, or budget approval.

Why this matters

Execution could cause unauthorized commission costs, attribution disputes, misleading endorsements, or violations of advertising-disclosure and platform rules, harming accounts and brand reputation.

Influencer partnerships and affiliate commissions are explicitly recommended promotion methods. If a partner promotes after receiving a free product, commission, or another benefit without disclosing the relationship, the user may face platform-rule, advertising-disclosure, budget, or brand-authorization risks. The free-device passage is a case study rather than a direct command, but it illustrates the model; “not a paid sponsorship” does not necessarily remove disclosure duties. Users could require written terms, budget approval, claim limits, and conspicuous-disclosure checks.

SKILL.md:86In the instructionsOpen original file
**Examples:**- Guest content (blog posts, podcast interviews, newsletter features)- Collaborations (webinars, co-marketing, social takeovers)- Speaking engagements (conferences, panels, virtual summits)- Influencer partnerships**Be proactive, not passive:**1. List industry leaders your audience follows2. Pitch win-win collaborations3. Use tools like SparkToro or Listen Notes to find audience overlap4. Set up affiliate/referral incentives (for channel partner launches, use [Introw](../../tools/integrations/introw.md) to manage deal registration and commissions)
Show 1 other places
SKILL.md:98In the instructionsOpen original file
**Example - TRMNL:**Sent a free e-ink display to YouTuber Snazzy Labs—not a paid sponsorship, just hoping he'd like it. He created an in-depth review that racked up 500K+ views and drove $500K+ in sales. They also set up an affiliate program for ongoing promotion.

Inside this skill

8 instruction sections

This Skill is a launch-marketing planning guide covering channels, phased releases, Product Hunt, post-launch work, and checklists. The supplied source contains no executable scripts, installation commands, or credential-handling implementation.

View source
SKILL.md:10In the instructionsOpen original file
You are an expert in SaaS product launches and feature announcements. Your goal is to help users plan launches that build momentum, capture attention, and convert interest into users.
SKILL.md:133In the instructionsOpen original file
## Five-Phase Launch ApproachLaunching isn't a one-day event. It's a phased process that builds momentum.

Before planning, the Skill tells the agent to read a product-marketing context file in the project and use it to avoid redundant questions. This is a local-read instruction and does not direct transmission to a third party.

View source
SKILL.md:14In the instructionsOpen original file
**Check for product marketing context first:**If `.agents/product-marketing.md` exists (or `.claude/product-marketing.md`, or the legacy `product-marketing-context.md` filename, in older setups), read it before asking questions. Use that context and only ask for information not already covered or specific to this task.

Its recommendations extend to real external commercial actions, including email, social platforms, partner promotion, self-service signup, and charging; the supplied source does not automate those actions.

View source
SKILL.md:192In the instructionsOpen original file
**Actions:**- Open self-serve signups- Start charging (if not already)- Announce general availability across all channels
SKILL.md:197In the instructionsOpen original file
**Launch touchpoints:**- Customer emails- In-app popups and product tours- Website banner linking to launch assets- "New" sticker in dashboard navigation- Blog post announcement- Social posts across platforms- Product Hunt, BetaList, Hacker News, etc.
Start here · InstructionsSKILL.md
launch
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 3 more sections are available in the original file.
Files and check records2 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • evals/evals.jsonFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • evals/evals.jsonSupporting file
Lines read
489
File checksum (to compare versions)
b0b8d557915e021ff3df964dfd068310bbb07683f90c7cd44234c15ff1683288