# Marketing Safe Launch

> Passive, read-only pre-launch attack-surface review of a marketing campaign that outputs an executive launch verdict.

- Type: Skill
- Author: Meg-CMO
- License: MIT
- Trust tier: contributed (passed automated validation and a baseline maintainer review)
- Last reviewed: 2026-07-30
- Source repository: https://github.com/Meg-CMO/marketing-safe-launch
- Repo state: not archived
- Last push: 2026-07-30T20:13:12Z
- Stars: 0 (a popularity signal, not a safety signal)
- Forks: 0 (a popularity signal, not a safety signal)
- Open issues: 0
- Language: HTML
- Health checked at: 2026-11-05T20:35:15.821Z
- Domains: application-security, threat-intelligence
- Tags: marketing-security, attack-surface, osint, pre-launch, lookalike-detection, passive-recon
- Date added: 2026-07-30
- Compatible platforms: Claude Code
- Invocation: `/marketing-safe-launch`
- Listing page: https://exchange.tenable.com/skills/marketing-safe-launch
- Source file: https://github.com/tenable/cyberagents-exchange/blob/main/skills/marketing-safe-launch.md

Marketing teams stand up campaign microsites, landing pages, forms, tracking
pixels, and martech integrations quickly — often outside normal security
workflows. Marketing Safe Launch gives a campaign owner a fast, defensible
answer to *"is this safe to launch?"* using only publicly observable
information, and delivers it as a single self-contained HTML report.

## What it does

Starting from a campaign's primary domain, the skill runs a **passive,
read-only** attack-surface review and produces an executive verdict —
**Ready**, **Ready with exceptions**, or **Hold** — with the reasoning shown:

- **Asset discovery** — enumerates subdomains and third parties (Certificate
  Transparency, DNS, page/header reads) and inventories scripts, tracking
  pixels, forms, and martech vendors.
- **Lookalike detection** — generates typo, omission, homoglyph, TLD-swap, and
  brand-keyword permutations and flags those that resolve or are mail-capable.
- **Passive risk findings** — surfaces observable issues (exposed dev/staging
  subdomains, missing security headers, software disclosure, non-TLS forms,
  certificate problems, risky third-party integrations), prioritized by a
  severity rubric.
- **Owner routing** — suggests an owner (Marketing / IT / Security / vendor) for
  each finding, as a label only — no tickets or email are sent.

## How it works

The skill follows a strict passive OSINT playbook using standard tooling
(`dig`, `whois`, `curl`, `openssl`, and public Certificate Transparency logs).
It never port scans, vulnerability scans, fuzzes, brute forces, or attempts to
exploit anything — every finding is indicative, and each report discloses
exactly which techniques were run against which domains. The output is a
self-contained HTML report (verdict banner, severity counts, asset inventory,
prioritized findings, lookalike domains, an attack-path narrative labeled as
inference, and a methodology/limitations section) that opens in any browser with
no server or network access required.

This is the Markdown version of one of 140 listings on CyberAgents Exchange. The same listing as JSON: https://exchange.tenable.com/api/skills/marketing-safe-launch.json. The full index and how to read it: https://exchange.tenable.com/llms.txt