setup — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited setup (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Run /setup to create a new, fully configured Marketing OS for your company. This is the first thing a user does after cloning marketing-os.
incoming/ (optional) to pre-fill brain filesAsk the user:
What's your company name?
Then derive the default path: ../[company-slug]-marketing/ (lowercase, hyphenated, sibling of the current directory).
Ask:
I'll create your marketing OS at [path]. Good, or would you prefer a different location?Ask the user:
Which AI coding agent do you primarily use? 1. Claude Code (Anthropic) — default 2. Codex (OpenAI)
This determines which runtime is "primary" — the canonical source for skills and instruction files. Both runtimes are always scaffolded; the primary just governs sync direction.
Store the choice as claude or codex.
Run the generator script to scaffold the new repo:
./scripts/create-instance.sh "[company-name]" "[target-path]" "[runtime]"Where [runtime] is claude or codex from Step 1b.
This script:
.claude/skills/ and .agents/skills/ (hardlinked)CLAUDE.md and AGENTS.md (identical except title and path references).marketing-os.yml with the primary runtime setting[FILL IN] placeholdersIf the script doesn't exist or fails, do the same work manually:
mkdir -p the directory tree.claude/skills/ and .agents/skills/CLAUDE.md and AGENTS.md.marketing-os.yml with primary_runtime: [claude|codex]git init && git add -A && git commit -m "Initial setup: [Company] marketing OS"All remaining steps operate on files in the NEW repo, not the marketing-os source repo.
Replace [COMPANY] in the new repo's README.md with the actual company name. Also replace [this-repo] in the Getting Started section with the repo's directory name.
This is a silent step — do it automatically, no need to confirm with the user.
Ask the user:
Optional follow-ups (ask if the user seems engaged, skip if they want speed):
Confirm the basics back in a summary table. Ask if anything needs correction.
If the user provided a website URL, offer:
Want me to read your website and pull in product details, messaging, and feature info? This can save a lot of manual entry.
If they agree:
If they decline, continue with manual entry.
Ask the user:
Do you have any existing documents you'd like me to reference? Things like messaging frameworks, product overviews, brand guidelines, competitive analyses, or pitch decks. If so, drop them in the incoming/ folder and I'll use them to pre-fill your brain files.If they have files:
incoming/ and confirm which ones to readIf they also did the website scrape in Step 3b, merge both sources. Where they conflict, ask the user which version is correct.
If they have no files, move on.
Using the answers from Steps 1, 3, and any imported reference documents (Step 3c), fill in [new-repo]/brain/truth.md:
[FILL IN] placeholders with the user's answers[FILL IN] for anything they didn't provideShow the user the updated file and confirm.
Ask the user:
Fill in the core sections of brain/positioning-and-messaging.md:
Fill in brain/competitive.md:
Leave detailed sections as [FILL IN]. Tell the user: "I've filled in the foundation. Run /product-marketing later to flesh out messaging pillars and the full competitive landscape."
Ask the user:
Fill in brain/personas.md with the three personas. Leave "Top Problems" and "What They Need" as [FILL IN].
If the user provided a website URL in Step 3, offer automatic extraction first:
Want me to extract your brand colors, fonts, and spacing from your website? I can pull them automatically using /design-extract.If they agree, run the design-extract skill (it installs designlang if needed, scrapes the site, and populates brand-guide.md).
If they decline or have no website, fall back to manual entry:
If they have details: fill in brain/brand-guide/brand-guide.md. If not: tell them the brand guide is there when they're ready, and move on.
Using the company name and product name:
styles/config/vocabularies/Brand/accept.txt with brand termsstyles/Brand/ to use the company name.vale.ini to reference the renamed directoryAsk: "Want to add your name to the Human Authority section, or any brand-specific writing rules? Or is the default good?"
Update CLAUDE.md (and AGENTS.md — keep them in sync) in the new repo if they want changes.
Show the user what integrations are available and ask which ones they want to set up:
The Marketing OS can connect to these services for analytics, image generation, and meeting notes. Which do you use?
| Service | What it powers | Required? |
|---|---|---|
| Google AI Studio | Image generation (/image-gen, blog hero images) | Optional |
| HubSpot | Email, page, and campaign analytics | Optional |
| Post and page analytics | Optional | |
| X / Twitter | Post analytics | Optional |
| YouTube | Channel and video analytics | Optional |
| Granola | Meeting notes for case studies and brain updates | Optional |
For each service they want to connect:
.env.example).env.example to .env if not already doneIf they don't want to set up any integrations now, tell them: "You can set these up anytime by editing .env — the instructions are in .env.example."
Run the /brain-health skill in "setup mode" (skip the interactive offer to start filling files). This shows the user exactly where they stand and what to do next.
The brain-health dashboard replaces the old flat list of "still to fill in" files. It shows completeness per file and maps each gap to the skill that fills it.
Commit all the configuration changes:
cd [new-repo]
git add -A
git commit -m "Configure brain files for [Company]"Present (adapt the commands based on the runtime they chose — / for Claude, $ for Codex):
Setup complete. Your marketing OS is at: [path]
Primary runtime: [Claude Code | Codex]
Brain files configured:
truth.md, positioning-and-messaging.md, competitive.md,
personas.md, brand-guide.md
Both runtimes scaffolded:
[primary dir]/skills/ (primary) [secondary dir]/skills/ (mirrored)
[PRIMARY].md (primary) [SECONDARY].md (mirrored)
To start working:
cd [path]
[claude | codex]Then offer to try the system right now:
Want to take it for a spin? Pick one:
>
1. Write a blog post — I'll draft a post using your positioning and voice (run/blog) 2. Run a competitive analysis — I'll research a competitor and build a comparison page (run/wf-competitive-positioning) 3. Skip for now — You can start anytime with the skills below
If they pick an option, route to that skill immediately. If they skip, show the skill reference:
Single tasks:
/blog Write a blog post
/copywriting Write landing page copy
/social-content Create social media posts
/case-studies Write a customer case study
/marketing-ideas Generate marketing tactics
Full workflows (multi-step pipelines):
/wf-blog-distribute Write a post and distribute across channels
/wf-landing-page Build a page end-to-end (copy → design → CRO → SEO → tracking)
/wf-campaign-launch Plan and run a multi-channel campaign
/wf-competitive-positioning Research competitors and build comparison pages
/wf-case-study-pipeline Customer conversation → case study → distribution
/wf-repurpose Fan existing content out to social, email, and ads
/wf-seo-sprint SEO audit → topic cluster → batch of optimized posts
/wf-ad-campaign Paid ads from strategy through creative and testing
Brain building:
/tone-mapping Build your voice profile from writing samples
/design-extract Extract brand colors and fonts from your website
/brain-health Check brain file completeness anytime
Utilities:
/analytics Check marketing performance
/tagore Strip AI patterns from any prose
/sync-skills Sync skills between runtimes
/start Start a session (loads context)
/brief End a session (checkpoint work)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.