Skip to content
skillsafebeta
← Report library
Purpose / Other

Marketing Ideas Skill Security Audit

What the author says it does (original text)

When the user needs marketing ideas, inspiration, or strategies for their SaaS or software product. Also use when the user asks for 'marketing ideas,' 'growth ideas,' 'how to market,' 'marketing strategies,' 'marketing tactics,' 'ways to promote,' 'ideas to grow,' 'what else can I try,' 'I don't know how to market this,' 'brainstorm marketing,' or 'what marketing should I do.' Use this as a starti

Independent security check

Security risks found

Files checked
4
Risks found
4
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 2
Medium risk

Audience sharing with partners could disclose customer or visitor data

Source references: 2
What we found

The catalog presents “sharing remarketing audiences” with complementary companies as a marketing method. Audience sharing can expose identifiable, matchable, or behavioral data to partners or ad platforms, without requiring checks for consent scope, privacy notices, contracts, or applicable law.

Why this matters

Visitors or customers could be linked and targeted across companies, leading to privacy complaints, regulatory exposure, advertising-account restrictions, or partner misuse of data.

This is an actionable marketing recommendation, not a warning or example: the catalog explicitly proposes sharing remarketing audiences with other companies. Implementing it may expose visitor identifiers or behavioral segments to partners or ad platforms, while the skill requires no prior check of consent, privacy notices, data-processing contracts, or local law. A user can require those checks before this tactic is recommended and restrict the shared fields and partner uses.

SKILL.md:17In the instructionsOpen original file
When asked for marketing ideas:1. Ask about their product, audience, and current stage if not clear2. Suggest 3-5 most relevant ideas based on their context3. Provide details on implementation for chosen ideas4. Consider their resources (time, budget, team size)
Show 1 other places
references/ideas-by-category.md:168In the instructionsOpen original file
60. **Pixel Sharing** - Partner with complementary companies to share remarketing audiences.
Low risk

Automatic context-file reading may carry internal business details into the response

Source references: 1
What we found

The Skill requires reading marketing context from hidden configuration directories or a legacy filename before asking questions, then using that content. It does not limit which fields are read or instruct the agent not to repeat confidential positioning, budgets, customer names, or competitor information.

Why this matters

If the file contains internal information, recommendations could unintentionally restate it in conversation history, shared outputs, or materials copied elsewhere.

What this evidence establishes

The skill does require automatically locating one of three marketing-context files and using its contents in the response process, which broadens the model's access to internal business material. However, the source does not show that those files contain confidential budgets, customers, or competitor data, nor does it direct verbatim reproduction, upload, or third-party transmission. Disclosure therefore is not established. Users can restrict permitted files or fields and require confidential and personal data to be omitted from answers.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:14In the instructionsOpen original file
**Check for product marketing context first:**If `.agents/product-marketing.md` exists (or `.claude/product-marketing.md`, or the legacy `product-marketing-context.md` filename, in older setups), read it before asking questions. Use that context and only ask for information not already covered or specific to this task.
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Medium risk

Engagement pods and follow-to-enter giveaways may manipulate metrics and endanger accounts

Source references: 2
What we found

The catalog recommends coordinating peers to boost each other’s engagement and giveaways requiring follows or retweets. These practices can create inauthentic engagement and may conflict with the promotion or authenticity rules of the social platform used.

Why this matters

A platform could reduce distribution, remove the promotion, or suspend social or advertising accounts. Inflated metrics may also distort the user’s own marketing decisions.

Both are active catalog recommendations. Engagement pods coordinate peers to boost one another's metrics, while the giveaway conditions entry on follows or retweets. If used, these may create inauthentic engagement and trigger a platform's authenticity or promotion rules, affecting the account or campaign. The text does not require a terms check. Users can require platform-specific compliance and exclude mandatory engagement or coordinated metric inflation.

references/ideas-by-category.md:126In the instructionsOpen original file
43. **Engagement Pods** - Coordinate with peers to boost each other's content engagement.44. **Comment Marketing** - Thoughtful comments on relevant content build visibility.
Show 1 other places
references/ideas-by-category.md:226In the instructionsOpen original file
83. **Twitter Giveaways** - Engagement-boosting giveaways that require follows or retweets.84. **Giveaways** - Strategic giveaways attract attention and capture leads.
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
Medium risk

Guerrilla examples could become costly physical campaigns without venue or recipient permission

Source references: 3
What we found

The reference encourages adapting patterns involving a large ice block at a competitor’s conference, skywriting over an event, and expensive oversized mailers to named targets. Its implementation checks relevance, targeting, and ROI, but does not require venue permission, public-safety review, recipient gift-policy checks, or legal review.

Why this matters

Copying these campaigns could cause property or safety incidents, event-operator claims, corporate-gift compliance problems, wasted budget, and reputational harm.

The cases are expressly presented as patterns to copy, and the later workflow tells the agent to choose a story, qualify recipients, ship, and scale, so they are more than historical description. Examples include placing a 600-pound ice block at another company's conference, skywriting over an event, and mailing oversized objects. Copying these without venue, airspace, property, or recipient permission could create safety, legal, property, or reputation risk. Users can require permits, safety, insurance, and recipient-policy review before any physical tactic.

references/guerrilla-marketing.md:29In the instructionsOpen original file
To reach marketing leaders who ignore cold email and screen their calls, Corey mailed **giant inflatable unicorn pool floaties** to a short list of hard-to-reach targets. The floatie is absurd, oversized, and impossible to ignore — it lands as a story, not a pitch (relevance + relationship), aimed at a hand-picked list where each closed deal dwarfs the package cost (precision + ROI discipline). Recipients remembered it, mentioned it, and replied.
Show 2 other places
references/guerrilla-marketing.md:35In the instructionsOpen original file
Steal the *pattern*, not the prop. Each of these turned a small, unconventional act into outsized attention or revenue.- **WePay's 600-lb ice block** — At PayPal's developer conference, WePay dropped a 600-pound block of ice with money frozen inside and a sign reading **"PayPal Freezes Your Accounts."** A pointed, physical jab at a competitor's real weakness, staged exactly where the audience was.- **Xero skywriting** — Xero paid for **skywriting over TechCrunch Disrupt**, hijacking a competitor-heavy event's attention from above without buying a booth.- **Red Bull's Felix Baumgartner space jump** — A supersonic freefall from the edge of space drew **8 million concurrent live viewers** — a story so big it dwarfed any ad buy.
references/guerrilla-marketing.md:50In the instructionsOpen original file
1. **Pick the story.** What's the one memorable thing a target would retell? Start from the story, then reverse-engineer the tactic.2. **Qualify the list.** For any high-cost play (direct mail especially), name the exact accounts and confirm the deal size justifies the spend.3. **Run the 3-rule check** on physical mail: relevance, relationship-building, precision targeting. If it fails any one, redesign it.4. **Test small.** Ship to a handful, measure replies/meetings/coverage, and only scale what earns a response.5. **Turn the stunt into a system.** If it works, make it repeatable — a recurring mailer program, a series of films, an ongoing library — rather than a one-time spike.

Inside this skill

7 instruction sections

This Skill is a marketing-advice catalog: it gathers product, audience, stage, and resource context, then recommends 3–5 ideas with implementation details. The provided files contain no installation or automatic campaign-execution steps.

View source
SKILL.md:17In the instructionsOpen original file
When asked for marketing ideas:1. Ask about their product, audience, and current stage if not clear2. Suggest 3-5 most relevant ideas based on their context3. Provide details on implementation for chosen ideas4. Consider their resources (time, budget, team size)

Before asking questions, the Skill proactively reads product-marketing context from one of three conventional locations and uses it to tailor recommendations.

View source
SKILL.md:14In the instructionsOpen original file
**Check for product marketing context first:**If `.agents/product-marketing.md` exists (or `.claude/product-marketing.md`, or the legacy `product-marketing-context.md` filename, in older setups), read it before asking questions. Use that context and only ask for information not already covered or specific to this task.

The guerrilla-marketing reference goes beyond examples: it directs the agent to choose a story, qualify target accounts, test on a small scale, and turn successful stunts into ongoing programs.

View source
references/guerrilla-marketing.md:48In the instructionsOpen original file
## How to Use This With a Client1. **Pick the story.** What's the one memorable thing a target would retell? Start from the story, then reverse-engineer the tactic.2. **Qualify the list.** For any high-cost play (direct mail especially), name the exact accounts and confirm the deal size justifies the spend.3. **Run the 3-rule check** on physical mail: relevance, relationship-building, precision targeting. If it fails any one, redesign it.4. **Test small.** Ship to a handful, measure replies/meetings/coverage, and only scale what earns a response.5. **Turn the stunt into a system.** If it works, make it repeatable — a recurring mailer program, a series of films, an ongoing library — rather than a one-time spike.

The catalog covers paid ads, partnerships, promotions, in-product growth, and unconventional campaigns, so its advice can affect advertising spend, customer experience, and brand reputation—not merely content ideation.

View source
SKILL.md:32In the instructionsOpen original file
| Free Tools | 14-22 | Calculators, Generators, Chrome extensions || Paid Ads | 23-34 | LinkedIn, Google, Retargeting, Podcast ads || Social & Community | 35-44 | LinkedIn audience, Reddit marketing, Short-form video || Email | 45-53 | Founder emails, Onboarding sequences, Win-back || Partnerships | 54-64 | Affiliate programs, Integration marketing, Newsletter swaps || Events | 65-72 | Webinars, Conference speaking, Virtual summits || PR & Media | 73-76 | Press coverage, Documentaries || Launches | 77-86 | Product Hunt, Lifetime deals, Giveaways || Product-Led | 87-96 | Viral loops, Powered-by marketing, Free migrations || Content Formats | 97-109 | Podcasts, Courses, Annual reports, Year wraps || Unconventional | 110-122 | Awards, Challenges, [Guerrilla marketing](references/guerrilla-marketing.md) || Platforms | 123-130 | App marketplaces, Review sites, YouTube || International | 131-132 | Expansion, Price localization || Developer | 133-136 | DevRel, Certifications || Audience-Specific | 137-139 | Referrals, Podcast tours, Customer language |
Start here · InstructionsSKILL.md
marketing-ideas
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.

File reference map

References: 3
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records4 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • references/guerrilla-marketing.mdFull text included
  • references/ideas-by-category.mdFull text included
  • evals/evals.jsonFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • evals/evals.jsonSupporting file
  • references/guerrilla-marketing.mdSupporting file
  • references/ideas-by-category.mdSupporting file
Lines read
702
File checksum (to compare versions)
3cf57799af352c03c3c6128149f791abf2c9cba8ec23d84c2d3abc3e466177bc