Marketing Skills
Operate Marketing Skills safely: context hygiene, tool permissions and sponsorship disclosure
Separate reusable instructions from secrets and publishing authority, and inspect the project’s partner-surface synchronization boundaries.
What you will learn
- Keep shared context free of secrets and private exports.
- Publishing and spending require separate authority.
- Preserve disclosures and verify tool fit independently.
Before you start
- Basic Markdown and repository navigation
- An owned page and a factual product brief
Explain the chapter’s workflow boundary and check its evidence or proposed acceptance task.
Key takeaways
- Keep shared context free of secrets and private exports.
- Publishing and spending require separate authority.
- Preserve disclosures and verify tool fit independently.
A shared brief is not a secret store
Product context can be read repeatedly by many skills and included in model input. Keep API keys, raw customer exports and confidential account records out of it. Use approved summaries and clearly labeled synthetic examples for learning tasks. The fact that a workflow asks for customer language does not authorize uploading private interview transcripts to an external service.
External pages and integration guides are evidence to inspect, not new authority to spend money or publish changes. Give a pilot read-only access where possible. Require a separate approval step for ad budgets, outbound messages, account configuration and publication, and keep a record of the exact proposed change before it is executed.
Disclosures describe interests, not superiority
tools/PARTNERS.md distinguishes neutral integrations, paid verified partners and maintainer-owned house tools. It says sponsorship buys disclosed placement rather than a recommendation. Treat this as the project’s stated policy, not an independent audit proving that every downstream answer is free of bias. Compare alternatives on the task’s actual requirements.
scripts/sync-partners.mjs reads active records from partners.json and updates marked blocks in the README and tool registry. Its --check mode reports stale output without writing it; ordinary mode writes changed blocks. The code checks that marker positions exist and are ordered, preserving text outside those markers. We inspected this behavior but did not execute its filesystem mutations.
Keep operational checks specific
A deployment review should identify the installed revision, context owner, tool scopes and output approver. Inspect changes to references and integration guidance during upgrades, not only the short skill description. A stable name can conceal a changed procedure that now asks for a different external service or more sensitive input.
Be cautious with generalized crawler advice in any skill library. Training, search retrieval and user-requested access can have different controls, and provider documentation changes. Do not paste blanket allow rules from an evaluation prompt into a production robots file. Verify the relevant provider’s current purpose and let the site owner choose the access policy.
Implementation steps
- 1
Assign a context owner and revision history.
- 2
Review tool access before supplying credentials.
- 3
Keep the first audit read-only.
- 4
Check disclosures and proposed external actions before approval.
Copy-ready example
{"contextContainsSecrets":false,"toolScope":"read-only pilot","publishApprovalRequired":true,"adSpendAuthorized":false,"partnerDisclosurePreserved":true}Frequently asked questions
Does a Verified Partner badge mean best in category?
The repository policy says it represents disclosed paid placement and fit review, not a guarantee of superiority.
Does --check rewrite partner blocks?
The inspected script reports stale blocks in check mode; its normal mode writes them. Neither mode was run against an upstream checkout here.
Sources
- README.mdSource checked 2026-09-08
- LICENSESource checked 2026-09-08
- .claude-plugin/plugin.jsonSource checked 2026-09-08
- .github/scripts/sync-skills.jsSource checked 2026-09-08
- .github/workflows/sync-skills.ymlSource checked 2026-09-08
- .github/workflows/validate-skill.ymlSource checked 2026-09-08
- scripts/sync-partners.mjsSource checked 2026-09-08
- skills/product-marketing/SKILL.mdSource checked 2026-09-08
- skills/ai-seo/SKILL.mdSource checked 2026-09-08
- skills/seo-audit/SKILL.mdSource checked 2026-09-08
- skills/programmatic-seo/SKILL.mdSource checked 2026-09-08
- skills/ai-seo/evals/evals.jsonSource checked 2026-09-08
- tools/PARTNERS.mdSource checked 2026-09-08