Skip to content
Report library
Purpose / Documents

Product Marketing Skill Security Audit

What the author says it does (original text)

When the user wants to create or update their product marketing context document. Also use when the user mentions 'product context,' 'marketing context,' 'set up context,' 'positioning,' 'who is my target audience,' 'describe my product,' 'ICP,' 'ideal customer profile,' or wants to avoid repeating foundational information across marketing tasks. Use this at the start of any new project before usi

Independent security check

Security risks found

Files checked
2
Risks found
1
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Broad repository reading can consolidate sensitive business or customer data into a file automatically used by other Skills

Source references: 5
What we found

The auto-draft workflow reads README files, pages, package metadata, and “any existing docs” without path limits, sensitive-file exclusions, or redaction rules. The resulting document can contain pricing, competitors, customer names, metrics, and testimonials, and is described as context that other marketing Skills use automatically.

Why this matters

If repository documents contain non-public pricing, customer identities, internal metrics, or competitive strategy, that material may be copied into persistent context and reused in later marketing tasks. The provided evidence does not show network transmission, but it broadens exposure within the agent workflow.

The risk is plausible, but only when the user chooses auto-drafting, and the workflow requires presenting the draft for review first. The Skill directs the agent to read “any existing docs,” can consolidate potentially sensitive customer names, metrics, and testimonials into shared context, and says other marketing Skills will use it automatically. The visible instructions provide no private-path exclusions or redaction rule. Users can ask the author to allowlist source files, exclude customer/secret/internal material by default, and require item-by-item approval before saving or reuse.

SKILL.md:36In the instructionsOpen original file
**If auto-drafting:**1. Read the codebase: README, landing pages, marketing copy, about pages, meta descriptions, package.json, any existing docs2. Draft all sections based on what you find3. Present the draft and ask what needs correcting or is missing4. Iterate until the user is satisfied
Show 4 other places
SKILL.md:57In the instructionsOpen original file
### 1. Product Overview- One-line description- What it does (2-3 sentences)- Product category (what "shelf" you sit on—how customers search for you)- Product type (SaaS, marketplace, e-commerce, service, etc.)- Business model and pricing
SKILL.md:117In the instructionsOpen original file
### 11. Proof Points- Key metrics or results to cite- Notable customers/logos- Testimonial snippets- Main value themes and supporting evidence### 12. Goals- Primary business goal- Key conversion action (what you want people to do)- Current metrics (if known)
SKILL.md:243In the instructionsOpen original file
  - Use today's date in ISO form (YYYY-MM-DD) for the entry and `Last updated`.  - **Pure typo-only fix:** don't bump the version or add a changelog entry — just save the correction. Every other change bumps the version and gets an entry. When the change is a real repositioning, say so plainly — downstream skills will now generate against the new context.- Save to `.agents/product-marketing.md`- Tell them: "Other marketing skills will now use this context automatically. The Changelog at the bottom tracks every revision — check it to see how your positioning has evolved. Run `/product-marketing` anytime to update it."
SKILL.md:244In the instructionsOpen original file
  - **Pure typo-only fix:** don't bump the version or add a changelog entry — just save the correction. Every other change bumps the version and gets an entry. When the change is a real repositioning, say so plainly — downstream skills will now generate against the new context.- Save to `.agents/product-marketing.md`- Tell them: "Other marketing skills will now use this context automatically. The Changelog at the bottom tracks every revision — check it to see how your positioning has evolved. Run `/product-marketing` anytime to update it."
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

5 instruction sections

The Skill checks several existing context-file locations and, when it finds only a legacy location, offers to move the file rather than directing an unconditional move.

View source
SKILL.md:16In the instructionsOpen original file
### Step 1: Check for Existing ContextFirst, check if `.agents/product-marketing.md` already exists. Also check `.claude/product-marketing.md` and the legacy filename `product-marketing-context.md` (in either `.agents/` or `.claude/`) for older setups — if found anywhere other than `.agents/product-marketing.md`, offer to move it to the canonical location.

For a new context, the recommended workflow reads product and marketing material from the repository to prepare a draft; the alternative gathers information through section-by-section questions.

View source
SKILL.md:26In the instructionsOpen original file
**If it doesn't exist, offer two options:**1. **Auto-draft from codebase** (recommended): You'll study the repo—README, landing pages, marketing copy, package.json, etc.—and draft a V1 of the context document. The user then reviews, corrects, and fills gaps. This is faster than starting from scratch.2. **Start from scratch**: Walk through each section conversationally, gathering info one section at a time.

The document is persistently saved as `.agents/product-marketing.md`; substantive updates increment its version, update the date, and preserve a newest-first revision history.

View source
SKILL.md:232In the instructionsOpen original file
## Step 4: Confirm, Version, and Save- Show the completed document- Ask if anything needs adjustment- **Set the version and changelog** — this is the paper trail for a doc every other skill reads:  - **New document:** set `Document version: v1` and a single Changelog entry — `- v1 ([today]) — Initial context.`  - **Updating an existing document:** increment the version (v2 → v3 …), update `Last updated` to today, and **prepend a new Changelog entry** at the top of the list (newest first) summarizing *what changed and why* in one line. Never rewrite or reorder past entries.  - A good entry names the sections touched and the reason, not "updated the doc." Examples:    - `- v3 (2026-07-16) — Repositioned from "email tool" to "deliverability platform"; added RevOps to the ICP.`    - `- v2 (2026-06-02) — Rewrote value prop and objections after 5 customer interviews; added competitor Acme.`  - Use today's date in ISO form (YYYY-MM-DD) for the entry and `Last updated`.  - **Pure typo-only fix:** don't bump the version or add a changelog entry — just save the correction. Every other change bumps the version and gets an entry. When the change is a real repositioning, say so plainly — downstream skills will now generate against the new context.- Save to `.agents/product-marketing.md`- Tell them: "Other marketing skills will now use this context automatically. The Changelog at the bottom tracks every revision — check it to see how your positioning has evolved. Run `/product-marketing` anytime to update it."

The workflow calls for presenting the draft and requesting corrections; its evaluation also explicitly expects review before saving.

View source
SKILL.md:36In the instructionsOpen original file
**If auto-drafting:**1. Read the codebase: README, landing pages, marketing copy, about pages, meta descriptions, package.json, any existing docs2. Draft all sections based on what you find3. Present the draft and ask what needs correcting or is missing4. Iterate until the user is satisfied
evals/evals.json:48In the instructionsOpen original file
      "id": 4,      "prompt": "Can you auto-draft our product marketing context from our existing codebase and marketing materials?",      "expected_output": "Should activate the auto-draft workflow mode. Should scan the codebase for existing marketing context: README, landing page copy, pricing page, about page, meta descriptions, any existing documentation. Should draft the product-marketing.md from what it finds, filling in sections where information is available and flagging sections that need manual input. Should present the draft for review before saving.",      "assertions": [        "Activates auto-draft workflow mode",        "Scans codebase for existing marketing materials",        "Drafts context from found information",        "Flags sections needing manual input",        "Presents draft for review before saving"      ],
Start here · InstructionsSKILL.md
product-marketing
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records2 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • evals/evals.jsonFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • evals/evals.jsonSupporting file
Lines read
355
File checksum (to compare versions)
174cce97c281530e7bb822d8fb831e28fc4ec62d2547efa7411446af3ba06a75