Live survey304 models · 14 providers · 22,792 auditsAudited grill-with-docs · SAFE →What changedHow we verifyllms.txt

Agent skill · Audited from source

Ops Gtm

skill · Lifecycle-Innovations-Limited/claude-opsMIT licenceAudited 31 Oct 2026 · source 8f7ccb60dfa1

★ 547pushed today
!CAUTIONGrade B · 89/100 · 1 finding · 8f7ccb6
547repo stars · whole Lifecycle-Innovations-Limited/claude-ops

Is it safe? With care — CAUTION, grade B (89/100). We read this skill's source at commit 8f7ccb60dfa1 and found no filesystem, network or shell access and no hard-coded secrets. The audit raised 1 finding, 1 critical or high. What it does: OPS on-demand: This skill should be used when the user asks to "go to market", "GTM plan", or...

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “Ops Gtm (Lifecycle-Innovations-Limited/claude-ops)”. Retrieved 31 Oct 2026. https://modelsatlas.com/skills/lifecycle-innovations-limited/ops-gtm

Trust audit

Audit 0.4.1 · source read 31 Oct 2026

Trust score89/100!CAUTION B
0 critical1 high0 medium0 low0 info

CAUTION means the audit found things worth knowing before you trust this skill. Grade B is shared by 16,667 of 17,602 audited skills.

What the source does

  • FilesystemNone observedNo reads or writes in the source
  • NetworkNone observedNo outbound calls in the source
  • ShellNone observedNo commands run in the source
  • DependenciesPinnedNothing floats
  • SecretsNone foundNo keys in source

Five audit layers

LayerWhat we checkResultFindings
L0 ProvenanceRepo owner, licence, archive status, activityPASS0
L1 Static sourceSecrets, path traversal, supply chain, hidden codeNA0
L2 InstructionsPrompt injection, authority framing, hidden directivesFAIL1
L3 InventoryThe files and declarations match the sourcePASS0
L4 SandboxRun in isolation and watch behaviourSKIPPED why0

Gates applied: no behavioural pass.

Findings (1)

HIGHPrompt injectionprompt.credential_read · SKILL.md:49
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
5. **`/marketing` credential probe (read-only)**: Do NOT re-resolve API keys in this skill. Instead, when the user asks to launch something, delegate to `/marketing` via the Skill tool — `/marketing`
Why
asks the agent to read credentials
Fix
—

Audit 0.4.1 · source sha 8f7ccb60dfa1 · 31 Oct 2026Report an issue or request a re-scan

Provenance

Who published it, and what the verdict is pinned to

  • PublisherLifecycle-Innovations-Limited GitHub organizationOwner of the repository this skill is read from
  • Source folderLifecycle-Innovations-Limited/claude-ops/claude-ops/skills/ops-gtmThe exact folder we audited
  • LicenceMITAs the repository states it
  • Commit pinned for this verdict8f7ccb60dfa1A new audit runs when the source changes
  • Repository statusNot archivedPushed today
  • Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

What it tells the agent

Full source on GitHub ↗

Its description: OPS on-demand: This skill should be used when the user asks to "go to market", "GTM plan", or...

---
name: ops-gtm
description: "OPS on-demand: This skill should be used when the user asks to \"go to market\", \"GTM plan\", or..."
argument-hint: '[plan|paid|unpaid|sales|automation|launch|brief|setup]'
allowed-tools:
  - Bash
  - Read
  - Write
  - Grep
  - Glob
  - Agent
  - TeamCreate
  - SendMessage
  - AskUserQuestion
  - WebFetch
  - WebSearch
  - Skill
effort: medium
maxTurns: 40
context: fork
---

# OPS ► GTM COMMAND CENTER

Load `ops-rules` before acting. Public repo (no personal data). Outbound: one draft → one approval → one send. If `AskUserQuestion` / `Workflow` are missing, follow Rule 10 in `ops-rules` (Hermes: numbered options / two-turn Telegram card; `delegate_task`).

Strategy layer that sits on top of `/marketing`. `/marketing` runs campaigns; `/gtm` decides what to run, across paid, unpaid, sales, and AI-automation channels, and then hands the executable pieces to `/marketing` via the Skill tool.

## Runtime Context

Before executing, load available context:

1. **Preferences**: Read `${CLAUDE_PLUGIN_DATA_DIR:-$HOME/.claude/plugins/data/ops-ops-marketplace}/preferences.json`
   - `timezone` — timestamp all output correctly
   - `gtm_default_project`, `gtm_default_audience`, `gtm_brand_voice` — project-level defaults when set
   - `gtm_monthly_budget`, `gtm_stage` (`pre-launch|beta|ga|scale`) — used to tune channel recommendations

2. **Cached plans**: List `${CLAUDE_PLUGIN_DATA_DIR}/gtm/*.md` to surface recent plans. Never overwrite a prior plan file — always append a new dated file.

3. **Daemon health**: Read `${CLAUDE_PLUGIN_DATA_DIR}/daemon-health.json`. If `action_needed` is not null, surface it before running any long planning flow.

4. **Repo auto-scan (background)**: For the current working directory, in parallel and with `run_in_background: true`:
   - `git remote -v` → infer project slug and org
   - `cat README.md` (or `README.*`) → product description, ICP hints
   - Glob `package.json`, `pyproject.toml`, `Cargo.toml`, `go.mod` → tech stack
   - Glob `.planning/**/*.md` and `docs/**/*.md` → prior briefs, positioning notes
   - Resolve: project name, one-line pitch, primary tech, existing channels hinted in the repo

5. **`/marketing` credential probe (read-only)**: Do NOT re-resolve API keys in this skill. Instead, when the user asks to launch something, delegate to `/marketing` via the Skill tool — `/marketing` owns the credential resolution chain (userConfig → env vars → Doppler → Dashlane → Keychain → gcloud ADC).

## Agent Teams support

If `CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=1` is set, use **Agent Teams** for the `plan` sub-command so the four research agents share context and report progress in real-time:

```
TeamCreate("gtm-research-team")
Agent(team_name="gtm-research-team", name="paid-research",       prompt="Research paid acquisition channels that fit ${PROJECT_TYPE} at ${STAGE} with $${MONTHLY_BUDGET}/mo. Return a ranked list with fit signals, expected CAC, and which /marketing sub-command (if any) executes each channel.")
Agent(team_name="gtm-research-team", name="unpaid-research",     prompt="Research organic channels (SEO, content, community, PR, partnerships, referrals, lifecycle email) for ${PROJECT_TYPE} at ${STAGE}. Return ranked list with effort estimate, time-to-signal, and /marketing sub-command mapping.")
Agent(team_name="gtm-research-team", name="sales-research",      prompt="Design a sales motion for ${PROJECT_TYPE}: outbound vs inbound vs PLG vs channel. Propose a 30/60/90 plan with concrete activities and target metrics.")
Agent(team_name="gtm-research-team", name="automation-research", prompt="Propose AI-automation recipes: lead enrichment, personalized outreach, content ops, lifecycle copy, support deflection, lead scoring. For each, list trigger, model/tool stack, and where it plugs into /marketing.")
```

If the flag is NOT set, use standard fire-and-forget subagents with the same four prompts.

---

## Sub-command Routing

Route `$ARGUMENTS` to the correct section below:

| Input         | Action                                                                                    |
| ------------- | ----------------------------------------------------------------------------------------- |
| (empty), plan | Full GTM plan across all four avenues                                                     |
| paid          | Paid acquisition deep-dive (Meta, Google, LinkedIn, TikTok, affiliates, sponsorships)     |
| unpaid        | Organic deep-dive (SEO, content, community, PR, partnerships, referrals, lifecycle email) |
| sales         | Sales motion (outbound, inbound, PLG, channel / partner)                                  |
| automation    | AI-automation playbook for GTM                                                            |
| launch        | 30/60/90 launch calendar + pre-flight checklist                                           |
| brief         | One-page positioning brief (ICP, value prop, messaging pillars)                           |
| setup         | Configure default project, audience, budget tier, brand voice                             |

Arguments are free-form — treat `/gtm plan for my-project $2k/mo pre-launch` as equivalent to `plan` with intake values pre-filled.

---

## Project Intake

Before producing any plan section, make sure the following are known. Source them in this order — only ask the user for what's still missing.

1. **Auto-scan the repo** (step 4 of Runtime Context).
2. **Read prefs** for `gtm_default_*` keys.
3. **Parse free-text in `$ARGUMENTS`** for budget, stage, and project name.
4. **AskUserQuestion for gaps** — respect Rule 1 (max 4 options per call; batch if needed).

Use these four questions in order, skipping any already known:

- **Project type** — `[B2B SaaS, B2C product, Marketplace, Dev tool / API]`
- **Stage** — `[Pre-launch, Beta / early access, GA (live), Scale (growth)]`
- **Primary goal (next 90 days)** — `[Awareness, Signups / leads, Revenue, Retention / expansion]`

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

Install

Pinned to the audited commit 8f7ccb6

Download folder ↗
git clone https://github.com/Lifecycle-Innovations-Limited/claude-ops
git -C claude-ops checkout 8f7ccb60dfa1

The author documents no install command, so this uses the repository directly. Our verdict covers commit 8f7ccb60dfa1 only.

Works in

The author has not said which agents this skill supports, and we have not tested it in any.

Audit history

Every audit, every source change

  1. !CAUTION B 89 / 100

    first audit · source 8f7ccb60dfa1

Questions about Ops Gtm

What does the Ops Gtm skill do?
Business operating system for Claude Code — 57 skills, 21 agents, smart daemon. Unified inbox (WhatsApp/Email/Slack/Telegram), autonomous PR merge, full-AWS monitoring, revenue (Stripe+RevenueCat), e-commerce (Shopify), marketing (Klaviyo/Meta/GA4), voice (Bland/ElevenLabs), APM (Datadog/NewRelic/OT
Is Ops Gtm safe to install?
With care. The audit graded it B (89/100) and found 1 thing worth knowing before you trust this skill, listed below with the exact line each was found on.
What can Ops Gtm access on my machine?
The audit observed no filesystem, network or shell use at all in its source.
How current is this page?
The grade is for one exact copy of the source (8f7ccb60dfa1), read on 2026-10-31. The repository is watched, and a new audit runs when it changes — this is the first audit.

Sources

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.