supercmo-skills 0.1.8__tar.gz

supercmo_skills-0.1.8/.claude-plugin/marketplace.json

@@ -0,0 +1,19 @@
+{
+  "name": "superCMO-skills",
+  "owner": {
+    "name": "SuperCMO",
+    "url": "https://getsupercmo.ai"
+  },
+  "metadata": {
+    "description": "Open, model-agnostic, BYO-keys marketing skills for AI agents",
+    "version": "0.1.8",
+    "repository": "https://github.com/SupercmoHQ/superCMO-skills"
+  },
+  "plugins": [
+    {
+      "name": "supercmo",
+      "description": "SuperCMO marketing skills — the whole repo installs as one plugin (everything under skills/ ships with it).",
+      "source": "./"
+    }
+  ]
+}

supercmo_skills-0.1.8/.claude-plugin/plugin.json

@@ -0,0 +1,9 @@
+{
+  "name": "supercmo",
+  "version": "0.1.8",
+  "description": "Open, model-agnostic, BYO-keys marketing skills for AI agents. Installing adds the whole skill set as one plugin; each skill also works standalone.",
+  "author": {
+    "name": "SuperCMO"
+  },
+  "repository": "https://github.com/SupercmoHQ/superCMO-skills"
+}

supercmo_skills-0.1.8/.claude-plugin/supercmo.json

@@ -0,0 +1,18 @@
+{
+  "keyword": "SUPERCMO",
+  "visible": false,
+  "skills": [
+    "generating-images",
+    "generating-videos",
+    "analyzing-products",
+    "generating-audio"
+  ],
+  "agents": [],
+  "references": [],
+  "scripts": [
+    "supercmo_env.py"
+  ],
+  "mcp_servers": [
+    "supercmo"
+  ]
+}

supercmo_skills-0.1.8/.codex-plugin/marketplace.json

@@ -0,0 +1,19 @@
+{
+  "name": "superCMO-skills",
+  "owner": {
+    "name": "SuperCMO",
+    "url": "https://getsupercmo.ai"
+  },
+  "metadata": {
+    "description": "Open, model-agnostic, BYO-keys marketing skills for AI agents",
+    "version": "0.1.8",
+    "repository": "https://github.com/SupercmoHQ/superCMO-skills"
+  },
+  "plugins": [
+    {
+      "name": "supercmo",
+      "description": "SuperCMO marketing skills — the whole repo installs as one plugin (everything under skills/ ships with it).",
+      "source": "./"
+    }
+  ]
+}

supercmo_skills-0.1.8/.codex-plugin/mcp.json

@@ -0,0 +1,8 @@
+{
+  "mcpServers": {
+    "supercmo": {
+      "command": "uvx",
+      "args": ["supercmo-skills@0.1.8"]
+    }
+  }
+}

supercmo_skills-0.1.8/.codex-plugin/plugin.json

@@ -0,0 +1,11 @@
+{
+  "name": "supercmo",
+  "version": "0.1.8",
+  "description": "Open, model-agnostic, BYO-keys marketing skills for AI agents. Installing adds the whole skill set as one plugin; each skill also works standalone.",
+  "author": {
+    "name": "SuperCMO"
+  },
+  "repository": "https://github.com/SupercmoHQ/superCMO-skills",
+  "skills": "./skills/",
+  "mcpServers": "./.codex-plugin/mcp.json"
+}

supercmo_skills-0.1.8/.gitattributes

@@ -0,0 +1,3 @@
+# The public projection never ships internal/ — `git archive` excludes it natively,
+# so even a publish that forgets to strip internal/ cannot leak it.
+internal/ export-ignore

supercmo_skills-0.1.8/.github/CODEOWNERS

@@ -0,0 +1,3 @@
+# Owner-approval gate: every change requires review from a repository owner.
+# (Enable "Require review from Code Owners" in the branch protection rule for this to enforce.)
+* @kshitizkgp @SayoniDuttaRoy

supercmo_skills-0.1.8/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,35 @@
+name: Bug report
+description: A skill or tool isn't behaving as documented.
+labels: [bug]
+body:
+  - type: input
+    id: skill
+    attributes:
+      label: Skill / tool
+      placeholder: e.g. generating-images
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: What you expected
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: What actually happened
+    validations:
+      required: true
+  - type: textarea
+    id: repro
+    attributes:
+      label: Steps to reproduce
+      description: Include the prompt/command. Redact any credentials.
+    validations:
+      required: true
+  - type: input
+    id: env
+    attributes:
+      label: Environment
+      placeholder: e.g. Claude Code 2.1.x, macOS 15

supercmo_skills-0.1.8/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/SupercmoHQ/superCMO-skills/blob/main/SECURITY.md
+    about: Do not file public issues for security problems — see our security policy.
+  - name: Question / discussion
+    url: https://github.com/SupercmoHQ/superCMO-skills/discussions
+    about: Ask questions and discuss ideas in Discussions.

supercmo_skills-0.1.8/.github/ISSUE_TEMPLATE/skill_request.yml

@@ -0,0 +1,21 @@
+name: Skill request / idea
+description: Propose a new skill or an improvement to an existing one.
+labels: [enhancement]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: What marketing job should this skill do?
+      description: Describe the task and when an operator would reach for it.
+    validations:
+      required: true
+  - type: input
+    id: category
+    attributes:
+      label: Category
+      placeholder: ads / seo / social / creative / analytics
+  - type: textarea
+    id: notes
+    attributes:
+      label: Anything else
+      description: Existing tools it would call, references, prior art.

supercmo_skills-0.1.8/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,20 @@
+<!-- Thanks for contributing to SuperCMO skills! -->
+
+## What this changes
+
+<!-- Brief description. Link any related issue. -->
+
+## Type
+
+- [ ] New skill
+- [ ] Change to an existing skill
+- [ ] Shared script / MCP tool (`scripts/`, `scripts/supercmo_skills/mcp/`)
+- [ ] Docs / repo infrastructure
+
+## Checklist
+
+- [ ] No credentials, tokens, or secrets are committed (keys come from env vars).
+- [ ] `name` matches the folder; `description` says **what + when** and is ≤ 1024 chars.
+- [ ] Passes local validation — `python3 scripts/quick_validate.py`, `scripts/listing_gate.py`, `scripts/check_shared_client.py` (CI runs the same).
+- [ ] SKILL.md body is under ~500 lines; detail is in `references/`.
+- [ ] Any script that mutates remote state supports `--dry-run` and defaults to paused/inactive.

supercmo_skills-0.1.8/.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+  - package-ecosystem: pip
+    directory: "/"
+    schedule:
+      interval: weekly

supercmo_skills-0.1.8/.github/workflows/release.yml

@@ -0,0 +1,108 @@
+name: Release
+
+# Tag a release — the tag must match package.json "version". scripts/bump_version.py keeps every
+# manifest + uvx pin in sync from that one value; the assert below re-checks it before publishing.
+#   python3 scripts/bump_version.py X.Y.Z   then   git tag vX.Y.Z && git push origin vX.Y.Z
+#
+# Jobs:
+#   release       — always: build the plugin bundle + GitHub Release (no external publish).
+#   pypi-publish  — publishes supercmo-skills to PyPI via OIDC Trusted Publishing (the uvx package
+#                   + the MCP-registry backing package). GATED by the `pypi` environment.
+#   npm-publish   — publishes @supercmo/skills to npm via OIDC Trusted Publishing. GATED by `npm`.
+#   mcp-registry  — registers server.json in the official MCP registry (needs the PyPI package live).
+#                   GATED by `mcp-registry`.
+#
+# THE GATE: the three publish jobs use protected GitHub Environments. Configure each environment with
+# required reviewers (the Final Launch Check approver) so a tag push PAUSES for approval instead of
+# publishing. A tag alone never publishes.
+
+on:
+  push:
+    tags: ["v*"]
+
+permissions: {}
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write   # create the GitHub Release + upload the asset
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+      - name: Assert tag matches package.json + every manifest version + uvx pin
+        run: python3 scripts/bump_version.py --check --tag "$GITHUB_REF_NAME"
+      - name: Build plugin bundle
+        run: |
+          python3 -m pip install --quiet pyyaml
+          python3 scripts/package_plugins.py
+      - name: Build .mcpb bundle (Smithery / Claude Desktop)
+        run: npx --yes @anthropic-ai/mcpb@latest pack mcpb dist/supercmo.mcpb
+      - name: Publish GitHub Release (idempotent)
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          # A pre-launch re-seed force-pushes the same tag, re-triggering this job. Create the release
+          # the first time; on a re-run the release already exists, so just refresh the assets
+          # instead of failing on "a release with the same tag name already exists".
+          if gh release view "$GITHUB_REF_NAME" >/dev/null 2>&1; then
+            gh release upload "$GITHUB_REF_NAME" dist/supercmo-plugin.zip dist/supercmo.mcpb --clobber
+          else
+            gh release create "$GITHUB_REF_NAME" dist/supercmo-plugin.zip dist/supercmo.mcpb --generate-notes
+          fi
+
+  pypi-publish:
+    needs: release
+    runs-on: ubuntu-latest
+    environment: pypi   # protect with required reviewers = the Final Launch Check gate
+    permissions:
+      id-token: write   # OIDC Trusted Publishing — no token stored
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - name: Build wheel + sdist
+        run: |
+          python3 -m pip install --quiet build
+          python3 -m build
+      - name: Publish to PyPI (OIDC)
+        uses: pypa/gh-action-pypi-publish@release/v1
+
+  npm-publish:
+    needs: release
+    runs-on: ubuntu-latest
+    environment: npm   # protect with required reviewers = the Final Launch Check gate
+    permissions:
+      contents: read
+      id-token: write   # OIDC Trusted Publishing — provenance auto-attached, no token
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          registry-url: "https://registry.npmjs.org"
+      - run: npm install -g npm@latest   # OIDC needs npm >= 11.5.1
+      - run: python3 -m pip install --quiet pyyaml   # prepublishOnly runs scripts/quick_validate.py
+      - run: npm publish --access public
+
+  mcp-registry:
+    needs: pypi-publish   # the registry entry points at the PyPI package — it must be live first
+    runs-on: ubuntu-latest
+    environment: mcp-registry
+    permissions:
+      id-token: write   # `mcp-publisher login github-oidc`
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install mcp-publisher
+        run: |
+          curl -L "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_linux_amd64.tar.gz" | tar xz mcp-publisher
+      - name: Publish server.json to the MCP registry
+        run: |
+          ./mcp-publisher login github-oidc
+          ./mcp-publisher publish

supercmo_skills-0.1.8/.github/workflows/secret-scan.yml

@@ -0,0 +1,28 @@
+# Scans every push and PR for committed secrets over the FULL history.
+# Runs the OSS gitleaks binary directly — NOT gitleaks/gitleaks-action@v2, which requires a
+# paid GITLEAKS_LICENSE for org-owned repos (SupercmoHQ) and hard-fails before scanning.
+# The binary is MIT and needs no license. A local gitleaks pre-commit hook is an optional
+# extra for maintainers.
+name: Secret scan
+on:
+  push:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  gitleaks:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0            # full history so gitleaks scans every commit
+      - name: Install gitleaks (OSS binary — no org license)
+        run: |
+          VERSION=8.21.2
+          curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${VERSION}/gitleaks_${VERSION}_linux_x64.tar.gz" \
+            | sudo tar -xz -C /usr/local/bin gitleaks
+          gitleaks version
+      - name: Scan full git history
+        run: gitleaks detect --source . --redact --verbose --exit-code 1

supercmo_skills-0.1.8/.github/workflows/validate.yml

@@ -0,0 +1,57 @@
+# Blocking validation: structural + frontmatter lint (quick_validate), the listing gate
+# (scripts smoke + spend/social --dry-run; listing_gate.py), and a plugin-bundle build smoke,
+# plus the Agent Skills spec validator (skills-ref) as an advisory check.
+name: Validate
+on:
+  push:
+    branches: [main, dev]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Structural + frontmatter validation (blocking)
+        run: |
+          pip install pyyaml
+          python3 scripts/quick_validate.py
+          python3 scripts/sync_skills.py --check   # README skills catalog must be in sync
+
+      - name: Listing gate — scripts smoke + spend/social --dry-run (blocking)
+        run: |
+          python3 scripts/listing_gate.py --selftest   # regression-test the gate logic
+          python3 scripts/listing_gate.py
+
+      - name: Shared-client seam — no raw vendor HTTP (blocking)
+        run: python3 scripts/check_shared_client.py
+
+      - name: Provider-key catalog in sync — registry vs .mcp.json/config.js (blocking)
+        run: python3 scripts/check_catalog_sync.py
+
+      - name: Plugin bundle build smoke (blocking)
+        run: python3 scripts/package_plugins.py   # must build a complete supercmo-plugin.zip (pyyaml installed above)
+
+      - name: Agent Skills spec validation (skills-ref)
+        # Not yet blocking: the skills-ref CLI interface is young — verify it, then
+        # remove continue-on-error to make it a hard gate.
+        continue-on-error: true
+        run: |
+          pip install skills-ref 2>/dev/null \
+            || pip install "git+https://github.com/agentskills/agentskills.git#subdirectory=skills-ref" 2>/dev/null \
+            || { echo "skills-ref not installable yet — skipping"; exit 0; }
+          for d in skills/*/; do
+            [ -f "${d}SKILL.md" ] && skills-ref validate "$d" || true
+          done
+
+      - name: Trigger evals (advisory)
+        # should-trigger / should-not-trigger per skill. Reports on PRs; never gates merge.
+        continue-on-error: true
+        run: python3 tests/evals/run_eval.py

supercmo_skills-0.1.8/.gitignore

@@ -0,0 +1,30 @@
+# Build and package output
+dist/
+
+# Python caching
+__pycache__/
+*.pyc
+*.pyo
+*.pyd
+.pytest_cache/
+.coverage
+htmlcov/
+
+# Local agents and test staging dirs
+.supercmo/
+.claude/
+
+# System specific files
+.DS_Store
+Thumbs.db
+
+# Environments
+.env
+.env.*
+
+# host-smoke generated media (not committed)
+_signoff-media/
+.gstack/
+
+# generated media output (default ./supercmo-media; tools write here)
+supercmo-media/

supercmo_skills-0.1.8/.mcp.json

@@ -0,0 +1,8 @@
+{
+  "mcpServers": {
+    "supercmo": {
+      "command": "uvx",
+      "args": ["supercmo-skills@0.1.8"]
+    }
+  }
+}

supercmo_skills-0.1.8/CONTRIBUTING.md

@@ -0,0 +1,55 @@
+# Contributing to SuperCMO Skills
+
+Thanks for adding a skill, agent, or MCP tool. This repo is one cross-host plugin: a skill you author
+runs unchanged in Claude Code, Cursor, Codex, Claude Cowork, and other SKILL.md-compatible hosts. Two
+rules are non-negotiable: **bring-your-own-keys** (never a key in the repo) and **route all
+vendor/network calls through `supercmo_env`** (CI enforces it).
+
+`skills/generating-images/` is the reference build — match its shape when in doubt.
+
+## Add a skill
+
+1. **Create the folder:** `skills/<your-skill>/` (folder name must equal the `name:` in frontmatter —
+   lowercase, hyphenated, `^[a-z0-9]+(-[a-z0-9]+)*$`). `skills/generating-images/` is the reference
+   layout to model it on.
+2. **Frontmatter:** `name`, `description` (state WHAT it does + WHEN to use it, including the trigger
+   phrases a user would say), `license: Apache-2.0`, and `metadata:` (`version`, `category`; add
+   `writes: spend | social` **only** for skills that spend money or post — it defaults to `none`, so
+   most skills omit it, like the reference skill does). No top-level `version`, no `platforms`, no
+   angle brackets in `name`/`description`.
+3. **Keep `SKILL.md` short.** Push doctrine into `references/`, deterministic work into `scripts/`.
+4. **Scripts are self-contained + BYOK:** stdlib-only where possible; read keys from the environment;
+   **import `supercmo_env` and call `supercmo_env._request` / `_request_raw`** for any network — never
+   `requests`/`httpx`/`urllib` directly. Anything that mutates remote state (posts, ad spend) must
+   support `--dry-run` (preview the request, secrets masked, no network) and default to paused.
+5. **Tag money/social actions:** set `metadata.writes: spend` or `social` so the listing gate requires
+   your `--dry-run`.
+6. **Add `evals/eval_cases.json`** (schema 2): `trigger_keywords` + should-trigger / should-not-trigger
+   `cases`. Copy the shape from `skills/generating-images/evals/`.
+7. **Validate before you push** (see below). Land each skill as a *complete* PR — folder + `SKILL.md` +
+   `evals/` together. Never commit an empty skill folder (the orphan gate fails).
+
+## Add an agent (subagent)
+
+The repo ships no subagents — a skill is portable across every host, while a subagent is
+host-specific and starts in a fresh context that does not inherit loaded skills. Reach for one only
+for genuine multi-step orchestration or a distinct reviewer role.
+
+- **Bundled role prompt (preferred):** a plain `skills/<name>/agents/<role>.md` with **no
+  frontmatter** — spawned inline by the skill, or run as steps if the host has no subagents. Keeps
+  the skill self-contained and portable.
+- **Standalone subagent:** an `agents/<name>.md` at the repo root with frontmatter — `name`,
+  `description` (the trigger/when-to-delegate), and optional `tools` / `model` / `skills` (preload).
+  Add it to `.claude-plugin/supercmo.json` → `agents`.
+
+## Validate (must pass before merge)
+
+```
+python3 scripts/quick_validate.py        # skills + agents + plugin manifests lint (blocking)
+python3 scripts/listing_gate.py          # scripts compile + spend/social --dry-run (blocking)
+python3 scripts/check_shared_client.py    # no raw vendor HTTP — the brokering seam (blocking)
+python3 tests/evals/run_eval.py           # trigger evals (advisory)
+```
+
+CI runs the same on every push/PR (`.github/workflows/validate.yml`). Secret scanning
+(`secret-scan.yml`) runs over full history — never commit a key.