Campaign Management

Read campaign packages, manage campaign state, generate intelligence reports. Entry point for all campaign operations.

Security Scan

The skill's instructions match a campaign-management purpose, but they are vague about how outreach and 'autonomous' actions will be performed and do not declare any credentials or limitations — this mismatch could lead to unexpected access or actions.

Purpose & Capability

Name/description and SKILL.md consistently describe reading campaign packages, tracking state, and producing reports. However the skill also describes 'outreach' and 'autonomous' modes (sending email/LinkedIn/social) that would normally require external account credentials and API access; those are not declared. The absence of required credentials is an incoherence worth flagging.

Instruction Scope

SKILL.md directs the agent to read and write campaign files (campaigns/<name>/, state.json, outbox, logs) which is expected, but instructions are high-level and open-ended (e.g., 'begins execution based on mode', 'researcher discovers' leads). There are no explicit constraints on data sources, no explicit steps for sending messages, and no guidance limiting what external endpoints or accounts the agent may call. This grants broad discretion to perform network actions and potentially send outreach without explicit safeguards.

Install Mechanism

Instruction-only skill with no install spec and no code files — lowest installation risk (nothing is written by an installer).

Credentials

No environment variables, credentials, or config paths are declared despite describing features that would typically require them (email provider credentials, OAuth tokens for LinkedIn/X, SMTP/API keys, domain management). The skill neither requests nor documents least-privilege access, raising ambiguity about how the agent is expected to obtain and use those secrets.

Persistence & Privilege

always is false and model invocation is allowed (normal). The combination of autonomous/outreach capabilities with autonomous invocation increases potential impact if the agent has access to sending credentials or network access, but the skill does not request permanent system-level privileges or modify other skills.

What to consider before installing

This skill appears to be a campaign manager that can discover leads and perform outreach, but the SKILL.md is vague about how outreach is executed and does not declare the credentials or connectors that would be required. Before installing or enabling it: - Ask the publisher which credentials or connectors it needs (SMTP/API keys, Google/Gmail/OAuth, LinkedIn/X tokens, social account tokens) and why. Require explicit declaration and least-privilege scopes. - Prefer to run without 'autonomous' outreach enabled until you know exactly how messages will be sent and have reviewed templates. - Confirm where the 'researcher' sources leads from (public web scraping, third-party data providers, internal systems) and ensure legal/privacy compliance. - Restrict the skill's filesystem access to a sandboxed campaigns/ directory and review logs/output before any network sends. - If you need higher assurance, request an implementation (code or connector list) or a provenance statement. More info that would raise confidence: explicit list of required environment variables/connector scopes, concrete command list for sending messages, and details on where lead data is sourced and stored.

Campaign Management Skill

Manages the lifecycle of marketing campaigns — reads packages, tracks state, generates reports.

Campaign Package Structure

Each campaign lives in campaigns/<name>/ with this structure:

campaigns/<name>/
  brief.md              # REQUIRED — product, audience, ICP, tone
  config.yaml           # REQUIRED — settings (mode, language, depth, platforms)
  leads.csv             # OPTIONAL — pre-loaded leads (if empty, researcher discovers)
  messages/             # OPTIONAL — message templates for outreach mode
    linkedin-connect.md
    email-cold.md
    email-followup-1.md
  assets/               # OPTIONAL — images, attachments

  # Generated by the system:
  enriched-leads.csv    # Output from researcher
  intel/                # Per-lead intelligence files
  outbox/               # Personalized messages (outreach/autonomous mode)
  state.json            # Campaign progress tracker
  report.md             # Final campaign report
  logs/                 # Execution logs

brief.md Format

# Campaign: [Name]

## Product
[What the product/service is. What problem it solves. URL if available.]

## Target Audience
- Industries: [fintech, healthcare, logistics, etc.]
- Titles: [CTO, VP Engineering, Head of Data, etc.]
- Geography: [Israel, US East Coast, Europe, etc.]
- Company size: [10-50, 50-500, 500+, Series A-C, etc.]

## Value Proposition
[Why this audience cares. What pain point we solve.]

## Tone
[Professional, casual, bold, warm, technical, etc.]

## Special Instructions
[Anything else — competitors to mention, angles to use, topics to reference]

config.yaml Format

mode: intelligence          # intelligence | outreach | autonomous
language: en                # en | he | both
research_depth: quick       # quick | deep

# Email settings (outreach/autonomous mode)
email_provider: gmail       # gmail | outlook
secondary_domain: null      # NEVER use primary domain for cold outreach

# Rate limits
linkedin:
  connections_per_day: 20
  messages_per_day: 50
  delay_seconds: 30
email:
  sends_per_hour: 20
  delay_seconds: 10
social:
  x_posts_per_day: 5
  reddit_posts_per_day: 3

# Schedule
active_hours: "09:00-18:00"
timezone: "Asia/Jerusalem"
workdays: [0, 1, 2, 3, 4]  # Sun-Thu

state.json Format

{
  "campaign": "congreat-data",
  "mode": "intelligence",
  "status": "running",
  "started_at": "2026-03-24T09:00:00Z",
  "updated_at": "2026-03-24T10:30:00Z",
  "leads": {
    "target": 100,
    "discovered": 45,
    "enriched": 30,
    "emails_found": 28,
    "phones_found": 12,
    "emails_verified": 20
  },
  "outreach": {
    "messages_drafted": 0,
    "emails_sent": 0,
    "linkedin_sent": 0,
    "replies": 0,
    "bounced": 0
  },
  "paused": false,
  "errors": []
}

Commands

/launch <campaign>

Start a campaign. Reads the package, validates it, begins execution based on mode.

/campaign-status <campaign>

Show current state.json — how many leads found, messages sent, etc.

/pause <campaign>

Set paused: true. All soldiers stop.

Report Generation

After intelligence mode completes, generate report.md:

# Campaign Intelligence Report: [Name]

## Summary
- Leads discovered: X
- Emails found: X (Y verified)
- Phone numbers found: X
- Industries covered: [list]
- Average intent score: X

## Top Leads (by intent score)
| Name | Title | Company | Email | Intent | Key Signal |
|------|-------|---------|-------|--------|------------|
| ...  | ...   | ...     | ...   | high   | ...        |

## Industry Breakdown
- Fintech: X leads
- Healthcare: X leads
...

## Recommended Next Steps
1. Review enriched-leads.csv
2. Switch to outreach mode when ready
3. Prepare message templates in messages/