superCMO-skills
Open-source skills that empower any AI agent (Claude, Cursor, Hermes, etc.) to generate end-to-end marketing campaigns - UGC videos, ad videos, product photography and more.
No outside reports on file
This tool lets AI create marketing content automatically, which is useful but risky if the AI receives bad instructions, if credentials leak, or if it generates misleading or fake content.
Based on public adoption and transparency signals as of Oct 26, 2026. Our opinion, not a code audit or security guarantee.
What it can access
- Local filesNo local folder access notedLOW
- Command executionNo shell command runner notedLOW
- Network reachConnects to outside service APINOTED
- CredentialsRequires API key or tokenREVIEW
- Package sourceGitHub (SupercmoHQ/superCMO-skills)PUBLIC
Inferred from this listing’s public package details and description. Check the project’s source before installing.
Install
No npm or PyPI package is listed. Install from source: github.com/SupercmoHQ/superCMO-skills ↗
Everything known
We found nothing about this project in the sources we read (last checked 2026-10-30). That does not mean it has no problems.
0 incidents · 0 advisories · 0 news articles · 0 community threads · checked 2026-10-30
Popularity grade: C (from public signals such as stars and downloads, not a code review). Graded 2026-10-26.
Sources we read: OSV, GitHub Advisory Database, CISA Known Exploited Vulnerabilities, 44 security news feeds and our incident library. Last checked 2026-10-30.
About superCMO-skills
This is a collection of open-source tools that add marketing capabilities to AI agents like Claude. It lets AI systems create marketing materials such as user-generated content videos, product ads, and product photos automatically.
Who it’s for
Marketing teams and businesses that want to use AI agents to speed up campaign creation. Developers building AI agent systems may also use these skills to add marketing features.
Alternatives
- Loom: Tool for recording and sharing marketing videos (no AI generation).
- Synthesia: AI video generation platform focused on avatar-based content.
- Canva: Design tool with templates for ads and social media (limited AI features).
- Adobe Firefly: Adobe's generative AI for images and video (more mature, closed-source).
Setup
Check these steps against the project’s own instructions before running anything.
Follow the project's README on GitHub at https://github.com/SupercmoHQ/superCMO-skills (opens external site) for installation and configuration instructions specific to your AI agent platform.
Why this grade
Signal-based grade (3/7 points): listed in several sources, public source code. This reflects adoption and transparency, not a code review.
Popularity and upkeep
- GitHub stars
- 257
- Listing last refreshed
- 2026-10-29
These are public popularity signals, not a maintenance check. Look at the repository’s commit history and open issues.
Risks to watch for
- Unvetted code: Open-source project with low adoption (230 stars) means fewer people reviewing it for security issues.
- AI misuse: The skill could generate misleading ads or videos if the AI is given bad instructions or a compromised prompt.
- API keys and credentials: If integrated with external services (video platforms, image tools), it may need access to API keys or tokens that could be leaked.
- Deceptive content: Without safeguards, the AI could create fake testimonials, deepfakes, or misleading product claims that appear real.
- Data exposure: Generated marketing files might accidentally contain sensitive business information if the AI isn't carefully prompted.
How to lower the risk
Least-privilege permissions
- Only grant this skill access to specific video and image APIs it actually needs.
- Never give it access to customer data, email lists, or payment systems.
Network isolation
- Run it in a sandboxed environment separate from your main business systems.
- Block outbound connections to unknown or untrusted services.
Monitoring
- Log all content generated and review samples regularly for misleading claims.
- Track API calls to external services and watch for unusual activity.
Red flags to watch for
- Generated content that looks deepfaked, fake, or misleading—review before publishing.
- Unexpected API calls or attempts to access external services not in your setup.
- AI suddenly requesting new permissions or credentials it didn't need before.
Questions
How do I install superCMO-skills?
superCMO-skills does not publish a standalone npm or PyPI package. Clone or follow the setup instructions in its source repository at github.com/SupercmoHQ/superCMO-skills.
Are there security reports about superCMO-skills?
No reports found for this package in our research (last checked 2026-10-30). superCMO-skills currently holds Grade C (Moderate risk signals) based on public adoption and transparency signals. Key risk areas to watch include unvetted code, ai misuse, api keys and credentials.
Is superCMO-skills actively maintained?
superCMO-skills has 257 GitHub stars. Our directory data was last refreshed on 2026-10-29. Check recent commit activity, release tags, and open issues at github.com/SupercmoHQ/superCMO-skills before pinning it in production.
What are alternatives to superCMO-skills?
Notable alternatives to superCMO-skills include Loom (Tool for recording and sharing marketing videos (no AI generation)), Synthesia (AI video generation platform focused on avatar-based content), Canva (Design tool with templates for ads and social media (limited AI features)), Adobe Firefly (Adobe's generative AI for images and video (more mature, closed-source)). You can also compare superCMO-skills side by side with other skills in the Related tools section on this page.
README badge and team notes
Maintain or use superCMO-skills? Show its live grade in your GitHub README, docs site, or run a check from the terminal before you install.
GitHub README Markdown:
[](https://agentarmorhq.com/skills/supercmohq-supercmo-skills)HTML embed:
<a href="https://agentarmorhq.com/skills/supercmohq-supercmo-skills"><img src="https://agentarmorhq.com/api/badge/supercmohq-supercmo-skills" alt="AgentArmorHQ Risk Grade for superCMO-skills" height="20" /></a>Terminal check:
curl -fsSL https://agentarmorhq.com/api/cli | node --input-type=module - check "supercmohq-supercmo-skills"Share with your security lead
Need sign-off to use superCMO-skills? Copy this note for Slack, a ticket or a pull request.
### AgentArmorHQ Security Review Memo: superCMO-skills
- **Listing URL:** https://agentarmorhq.com/skills/supercmohq-supercmo-skills
- **Type:** AI agent skill
- **Risk Grade:** Grade C (Moderate risk signals)
- **Outside Security Advisories on File:** 0
- **Public Adoption:** 257 GitHub stars
#### Permission & Blast-Radius Signals
- **Local files:** No local folder access noted
- **Command execution:** No shell command runner noted
- **Network reach:** Connects to outside service API
- **Credentials:** Requires API key or token
- **Package source:** GitHub (SupercmoHQ/superCMO-skills)
#### Recommended Hardened Setup
- **Source Repo:** https://github.com/SupercmoHQ/superCMO-skills
- **Controls:** Pin an exact version in `.mcp.json`, scope access to a single workspace folder, and use a least-privilege read-only token where supported.
_Based on public adoption and transparency signals as of Oct 26, 2026. Our opinion, not a code audit or security guarantee._Key facts
- Type
- AI agent skill
- Publisher
- SupercmoHQ
- Source code
- github.com/SupercmoHQ/superCMO-skills
- Est. context load
- ~71 tokens idle · ~450 tokens when active (on-demand skill)
- Popularity
- 257 GitHub stars
- Last updated
- 2026-10-29
- Last graded
- 2026-10-26
Community
Discussions for superCMO-skills
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.
Check before you install, in Claude
Your assistant answers Block, Review or No known issues for any package before it installs it.
Get this check inside Claude