Marketing Orchestrator

Orchestrates marketing data collection from Instagram, Meta Ads, SEO, competitors, and website audits to generate a comprehensive marketing audit report.

Security Scan

This is an instruction-only orchestration skill that coordinates other collector/reporting skills — its declared requirements and instructions are coherent with its stated purpose, but its safety depends entirely on the collector/report-generator skills it invokes and on how credentials are handled by the calling environment.

Purpose & Capability

The name/description (marketing orchestration) matches the SKILL.md: it sequences collectors (Instagram, Meta Ads, SEO, competitors, website audit) and calls a report-generator. It does not request unrelated env vars, binaries, or system access.

Instruction Scope

Runtime instructions are narrowly scoped to validating input, sequentially invoking named sub-skills, aggregating results, and calling a report-generator. This is within purpose. Note: the skill delegates external calls and credential handling to the 'calling framework' and other skills; the orchestrator itself does not describe how to handle sensitive data from those sub-skills.

Install Mechanism

No install spec and no code files — instruction-only. Nothing is written to disk and there is no install-time risk from this skill itself.

Credentials

This skill declares no required env vars or credentials, which is proportional. However, it explicitly relies on other collector/reporting skills and the environment to provide API keys and secrets; therefore the effective credential surface depends on those downstream skills (not visible here).

Persistence & Privilege

always:false and no config paths are requested. The skill does not request persistent/system-wide privileges or modify other skills. Autonomous invocation is allowed (platform default) but is not an additional privilege requested by this skill.

Assessment

This orchestrator is internally consistent and lightweight: it only sequences other skills and aggregates results. Its security posture depends on the collector and report-generator skills it calls and on the surrounding runtime that supplies API keys. Before installing or enabling it, verify the provenance and permissions of each referenced sub-skill (instagram-collector, meta-ads-collector, seo-collector, competitor-finder, website-audit, report-generator). Confirm where and how API keys will be stored and used (use scoped, least-privilege keys and short-lived tokens where possible), test the orchestration in a sandbox, and review logs/outputs from each collector to ensure no unexpected data exfiltration. Because the package has no homepage and an unknown source, exercise extra caution and inspect the downstream skills' manifests and code (or restrict the orchestrator to a trusted set of known collectors) before granting it broad access.

Marketing Orchestrator Skill

Purpose

Orchestrates the marketing audit pipeline by sequentially running the following collector agents:

• Instagram Collector
• Meta Ads Collector
• SEO / Keyword Collector
• Competitor Finder
• Website Audit Collector

Aggregates the individual results and invokes the Report Generator skill to produce the final comprehensive marketing audit report.

Input Schema

interface MarketingInput {
  instagramHandle?: string;
  websiteDomain?: string;
}

Output Schema

interface MarketingAuditReport {
  reportMarkdown: string;
  rawData: any;
  error?: string;
}

Implementation Pattern

• Validate input: either instagramHandle or websiteDomain is required
• Sequentially call each collector skill, passing relevant input
• Collect results in a composite data object
• Call report-generator skill with the aggregated data
• Return the final report markdown and raw data

Example Usage

const input = { instagramHandle: 'gymshark', websiteDomain: 'gymshark.com' };
const report = await marketingOrchestrator(input);
console.log(report.reportMarkdown);

Orchestration Logic (Pseudocode)

async function marketingOrchestrator(input: MarketingInput): Promise<MarketingAuditReport> {
  if (!input.instagramHandle && !input.websiteDomain) {
    throw new Error("Either instagramHandle or websiteDomain is required");
  }

  const auditData: any = {
    input,
    collectedAt: new Date().toISOString(),
  };

  if (input.instagramHandle) {
    auditData.instagram = await runSkill('instagram-collector', { handle: input.instagramHandle });
  }

  if (input.websiteDomain) {
    auditData.metaAds = await runSkill('meta-ads-collector', { brandName: input.websiteDomain, domain: input.websiteDomain });
    auditData.keywords = await runSkill('seo-collector', { domain: input.websiteDomain });
    auditData.competitors = await runSkill('competitor-finder', { brandName: input.websiteDomain, domain: input.websiteDomain });
    auditData.websiteAudit = await runSkill('website-audit', { domain: input.websiteDomain });
  }

  const report = await runSkill('report-generator', auditData);

  return {
    reportMarkdown: report.reportMarkdown,
    rawData: auditData,
  };
}

Notes

• Each runSkill call corresponds to invoking another skill as a sub-agent or subprocess.
• The calling framework should handle API keys, env vars for external services.
• Errors in individual collectors should not block the overall orchestration.
• Extend as needed for additional collectors or data sources.