marketing-cli
Agent-native marketing playbook: 76 skills, 6 research/review agents, brand memory that compounds, plus a local Studio dashboard (beta). One install, then /cmo in Claude Code walks you through a 4-question setup wizard. CLI for the agent, Studio for the h
This report shows the evidence for marketing-cli@0.7.0, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiSource confirms concrete postinstall persistence into ~/.claude/skills and ~/.claude/agents plus runtime npm installation. This meets the install-control-surface block policy.
Decision evidence
public snapshot- Install lifecycle invokes postinstall.
- On global install, it copies bundled skills into ~/.claude/skills.
- It installs bundled agent files into ~/.claude/agents.
- It additionally runs npm i -g for another package during postinstall.
- Hook skips non-global installs.
- No credential exfiltration is shown in the lifecycle hook.
Source & flagged code
10 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgFindings
Affected versions and remediation
This report applies to marketing-cli@0.7.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing marketing-cli@0.7.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.