digital-marketing-proBLOCK

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: ab-test-plan
description: "Plan an A/B test by script: sample size per variant, days to run, stopping rules. \"how many visitors per variant\""
argument-hint: "[element-to-test]"
---

# /digital-marketing-pro:ab-test-plan

> **Script location.** If your host does not set `${CLAUDE_PLUGIN_ROOT}`, the scripts are in this plugin's `scripts/` folder, next to `skills/`. Run them with Python 3.10 or newer: `python`, or `python3` where `python` is not found (macOS, many Linux systems).

## Purpose

Dedicated A/B test planning with a structured hypothesis framework, statistical sample size calculation, variant design, and monitoring plan. Produces a complete experiment specification with statistical rigor and clear decision criteria.

## Input Required

The user must provide (or will be prompted for):

- **Element to test**: The specific page, component, or experience being tested (landing page headline, CTA button, pricing page layout, email subject line, checkout flow, form design, etc.)
- **Current conversion rate**: Baseline conversion rate for the metric being tested (or best estimate)
- **Desired minimum detectable effect (MDE)**: The smallest improvement worth detecting. **MDE is ABSOLUTE by default** — expressed in the same units as the baseline (baseline 5.0% and you want to catch a +1.0 percentage-point lift, i.e. 5.0% → 6.0% ⇒ `--mde 0.01 --mde-type absolute`). To express it as a **relative** lift instead (a 10% relative improvement on a 5% baseline = 5.5% ⇒ `--mde 0.10 --mde-type relative`), pass `--mde-type relative`. This distinction is the single most common sample-size error: the same "10%" read as absolute vs. relative changes the required sample size by roughly two orders of magnitude (~200×) at a 5% baseline. Always confirm which the user means.
- **Daily traffic or impressions**: Average daily visitors or impressions to the test page or element
- **Significance level**: Desired confidence level, default 95% (alpha = 0.05)
- **Statistical power**: Desired power, default 80% (beta = 0.20)
- **Number of variants**: How many variants to test (default 1 treatment + 1 control; more for multivariate)
- **Business context**: What prompted the test idea (analytics data, user feedback, competitive analysis, heuristic audit, stakeholder request)

## Process

1. **Load brand context**: Read `~/.claude-marketing/brands/_active-brand.json` for the active slug, then load `~/.claude-marketing/brands/{slug}/profile.json`. Apply voice, compliance, industry context. Check `guidelines/_manifest.json` for restrictions, messaging, channel styles, voice-and-tone rules, and templates. If a template matching this command exists in `~/.claude-marketing/brands/{slug}/templates/`, apply its format. If no brand exists, prompt for `/digital-marketing-pro:brand-setup` or proceed with defaults.
2. **Check campaign history**: Run `python "${CLAUDE_PLUGIN_ROOT}/scripts/campaign-tracker.py" --brand {slug} --action list-campaigns` to review past test results and avoid re-testing already-validated hypotheses.
3. **Run sample size calculator**: Execute the calculator with the baseline rate, MDE, MDE type, significance, and power. The `--mde-type` flag defaults to `absolute` — always confirm with the user which interpretation they mean before computing (the two differ by roughly two orders of magnitude, ~200×, at a 5% baseline):
   ```bash
   # Absolute MDE — detect a 1.0 percentage-point lift on a 5% baseline (5.0% → 6.0%)
   python "${CLAUDE_PLUGIN_ROOT}/scripts/sample-size-calculator.py" --baseline-rate 0.05 --mde 0.01 --mde-type absolute --significance 0.95 --power 0.80

   # Relative MDE — detect a 10% relative lift on a 5% baseline (5.0% → 5.5%)
   python "${CLAUDE_PLUGIN_ROOT}/scripts/sample-size-calculator.py" --baseline-rate 0.05 --mde 0.10 --mde-type relative --significance 0.95 --power 0.80
   ```
   This determines the required sample size per variant. Later, when the test has run, evaluate the result with `python "${CLAUDE_PLUGIN_ROOT}/scripts/significance-tester.py" --control-visitors {n} --control-conversions {n} --variant-visitors {n} --variant-conversions {n} --confidence 0.95`.
4. **Build hypothesis statement**: Structure the hypothesis in the format: "If [specific change], then [primary metric] will [direction and magnitude] because [rationale grounded in data, user research, or established UX principle]."
5. **Design test variants**: Define the control (current experience) and one or more treatment variants. Specify exactly what changes in each variant -- copy, layout, color, imagery, flow, or functionality. For multivariate tests, define the variable matrix and interaction effects to watch.
6. **Define primary and secondary metrics**: Identify the primary success metric (the one that determines the winner) and secondary metrics to monitor for unintended effects (e.g., testing CTA click rate as primary, but watching bounce rate, time on page, and downstream conversion as secondary guardrails).
7. **Calculate test duration**: Based on sample size requirements and daily traffic, estimate the number of days needed. Ensure the duration spans at least one full business cycle (7 days minimum) to account for day-of-week variation. Flag if duration exceeds 8 weeks (validity risk).
8. **Create monitoring plan**: Define interim checkpoints for technical QA (not statistical peeking), sample ratio mismatch (SRM) detection, and guardrail metric alerts that would trigger early test stoppage for data quality or user experience reasons.
9. **Define stopping rules and decision criteria**: Specify when to call the test (sample size reached + significance threshold met), when to stop early (guardrail violations, SRM detected, implementation bugs), and the protocol for inconclusive results (extend, redesign, or implement based on directional signal).
10. **Assess traffic feasibility**: Verify that the daily traffic can reach the required sample size within a reasonable timeframe (under 8 weeks). If traff

BLOCKgrade F · trust 49/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

What the source does

Filesystem

declared (2 observation(s))

Network

declared (7 observation(s))

Shell

declared (1 observation(s))

Dependencies

pinned

Secrets in source

found

Findings (25)

- **Content Credentials 2.3** (released 9 February 2026 — [launch post](https://c2pa.org/the-c2pa-launches-content-credentials-2-3-and-celebrates-5-years-of-impact-across-the-digital-ecosystem/)) adde

# Digital Marketing Pro

__import__(import_name)

"realm", "beacon", "cacophony", "testament", "pivotal", "landscape",

TOKEN = "xoxb-test-token-123"

ENV = {"SLACK_BOT_TOKEN": "xoxb-test-token-123"}

TOKEN = "xoxb-test-token-123"

SLACK_BOT_TOKEN="xoxb-test-token-123", PYTHONIOENCODING="utf-8")

.mcp.json.connectors-reference

.mcp.json.example

return int(hashlib.md5(raw.encode()).hexdigest()[:8], 16)

correction_id = hashlib.md5(f"{campaign_id}-{ts}".encode()).hexdigest()[:12]

copilot = {"skills": "../../skills/", "mcpServers": "../../.mcp.json"}

[".github/plugin/plugin.json points at ../../.mcp.json, which does not ship"])

self.assertEqual(resolve(".github/plugin/plugin.json", "../../skills/"), "skills")

bad = ["../x", "../../etc/passwd", "..\\x", "a/b", "a\\b", "/etc/passwd", "C:\\Windows", "C:",

for raw in ("../../outside", str(tmp / "outside"), "..\\..\\outside"):

"meta.example": "169.254.169.254",

"http://169.254.169.254/": False,

for url in ("http://lan.example/", "file:///etc/hosts", "http://169.254.169.254/"):

return {"method": "POST", "url": f"http://127.0.0.1:{port}/api/chat.postMessage",

out["url"] = f"http://127.0.0.1:{port}/api/chat.postMessage"

"http://127.0.0.1/": False,

"http://169.254.169.254/": False,

for url in ("http://lan.example/", "file:///etc/hosts", "http://169.254.169.254/"):

Gates applied: critical_finding, no_behavioural_pass, undeclared_transfer.