ops-gtm
Generates comprehensive go-to-market plans across various channels, integrating marketing and sales strategies for effective execution.
Install this skill
Security score
The ops-gtm skill was audited on May 29, 2026 and we found 8 security issues across 2 threat categories, including 7 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 30 | 1. **Preferences**: Read `${CLAUDE_PLUGIN_DATA_DIR:-$HOME/.claude/plugins/data/ops-ops-marketplace}/preferences.json` |
Template literal with variable interpolation in command context
| 35 | 2. **Cached plans**: List `${CLAUDE_PLUGIN_DATA_DIR}/gtm/*.md` to surface recent plans. Never overwrite a prior plan file — always append a new dated file. |
Template literal with variable interpolation in command context
| 37 | 3. **Daemon health**: Read `${CLAUDE_PLUGIN_DATA_DIR}/daemon-health.json`. If `action_needed` is not null, surface it before running any long planning flow. |
Template literal with variable interpolation in command context
| 52 | ``` |
Template literal with variable interpolation in command context
| 203 | 4. **Persist the plan** to `${CLAUDE_PLUGIN_DATA_DIR}/gtm/<project-slug>-$(date +%Y-%m-%d).md` (create the directory if missing). Never overwrite — if the file exists, append `-v2`, `-v3`. |
Template literal with variable interpolation in command context
| 299 | Fast path — does NOT spawn the four research agents. Just intake + a single call to write the brief. Fields: **ICP**, **Pain**, **Value prop**, **3 messaging pillars**, **Proof points**, **Anti-positi |
Template literal with variable interpolation in command context
| 339 | - **Rule 0 — public repo**: every example above uses `your-project`, `[email protected]`, `<YOUR_TOKEN>`. Never save user-specific data outside `$PREFS_PATH` or `${CLAUDE_PLUGIN_DATA_DIR}/gtm/`. |
Access to system keychain/keyring
| 46 | 5. **`/marketing` credential probe (read-only)**: Do NOT re-resolve API keys in this skill. Instead, when the user asks to launch something, delegate to `/marketing` via the Skill tool — `/marketing` |