zubair-trabzada/ai-marketing-claude

Review signals: 1 connection review, 1 download and execute.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 4 distinct locations. 4 attributed processes.

Source contains download and execute; review its purpose. install.sh

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• social calendar generator: Real input produced the expected result: "topic": "AI automation"

  Source: Social content calendar generator

  Input: AI automation linkedin,twitter 7

  Expected: JSON calendar for the topic

  Command: python3 scripts/social_calendar.py 'AI automation' linkedin,twitter 7

  Observed: "topic": "AI automation", "brand": "AI automation", "platforms": [ "linkedin", "twitter" ], "duration_days": 7, "start_date": "2026-10-25", "end_date": "2026-11-01", "posting_schedule": { "linkedin": { "ideal": "3-5x/week", "minimum": "2x/week", "best_times": "Tue-Thu 8-10am, 12pm" }, "twitter": { "ideal": "3-5x/day", "minimum": "1x/day", "best_times": "9am, 12pm, 5pm" } }, "content_pillars": { "educational": { "name": "Educational", "description": "Teach your audience something valuable", "freq

• automated page analysis: Real input produced the expected result: "title": "Example Domain"

  Source: automated page analysis, competitor scanning

  Input: https://example.com

  Expected: SEO analysis with title Example Domain

  Command: python3 scripts/analyze_page.py https://example.com

  Observed: "title": "Example Domain", "title_length": 14, "title_ok": false, "meta_description": "", "meta_description_length": 0, "meta_description_ok": false, "canonical": "", "robots_meta": "", "has_viewport": true, "og_tags": {}, "headings": {}, "heading_issues": [ "Missing H1 tag" ], "images_total": 0, "images_without_alt": 0, "images_with_lazy_loading": 0 }, "content": { "word_count": 32, "headings_count": 0, "h1": [], "h2": [] }, "conversion": { "ctas": []

Examples

• Generate a social media content calendar from the CLI: command completed successfully

  Source: scripts/social_calendar.py usage

  Input: AI automation linkedin,twitter,instagram 30

  Expected: 30-day calendar JSON for the topic

  Command: python3 scripts/social_calendar.py 'AI automation' linkedin,twitter,instagram 30

  Observed: flow": [ "1. Create a long-form piece about AI automation (blog post or YouTube video)", "2. Extract 5-7 key insights as individual social posts", "3. Turn each insight into a platform-specific format", "4. Create a carousel/thread from the full piece", "5. Film a 60s summary as a Reel/TikTok", "6. Pull quotes for image posts", "7. Create a poll or question from one insight", "8. Share behind-the-scenes of creating the content", "9. Reshare top-performing posts 2-4 weeks later", "10. Create a 'best of' compilation monthly" ] } }

Local or hosted: local

Install the AI Marketing Suite skills with the README installer, then run the documented Python CLIs (social calendar generator and page analyzer)

cd <guest-path> && pwd && ls -la && id -u && python3 --version && (git status 2>&1 | head -3) && echo --- && head -c 6000 README.md
cd <guest-path> && tail -c 1800 README.md; echo ---; cat requirements.txt; echo ---; ls scripts templates; echo ---; sed -n 1,60p scripts/analyze_page.py | head -80; ls <guest-path> /inputs 2>&1; curl -s -m 5 -o /dev/null -w '%{http_code}\n' $CDP_URL/json/version
cd <guest-path> && curl -s -m 5 -w '\nHTTP %{http_code}\n' $CDP_URL/json/version; echo ---; sed -n 1,80p install.sh
cd <guest-path> && grep -n "argv\|argparse\|add_argument\|__main__\|usage" scripts/*.py | head -60
cd <guest-path> && bash ./install.sh </dev/null 2>&1 | tail -25; echo "exit=${PIPESTATUS[0]}"; ls ~/.claude/skills | head -30
cd <guest-path> && sed -n 180,240p scripts/social_calendar.py
cd <guest-path> && mkdir -p <guest-path> && python3 scripts/social_calendar.py 'AI automation' linkedin,twitter 7 > <guest-path>; echo "exit=$?"; python3 -c 'import json,sys; d=json.load(open("<guest-path>")); print(list(d.keys())); print(len(d["calendar"]))' ; echo ---; timeout 40 python3 scripts/analyze_page.py https://example.com | head -c 600; echo; echo "exit=${PIPESTATUS[0]}"
cd <guest-path> && grep -rniE "cron|schedule|--once|--now|while True|webhook|daemon" --include=*.py --include=*.sh --include=*.md . | grep -v "^./skills/" | head -20; echo ---; grep -n "argv\|def main" scripts/generate_pdf_report.py | head; sed -n 415,430p scripts/generate_pdf_report.py; python3 -m venv --help >/dev/null 2>&1 && echo venv_ok
cd <guest-path> && mkdir -p .coldpass && cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["python3","scripts/social_calendar.py","AI automation","linkedin,twitter","7"],"cwd":"<guest-path>","expected_text":"\"topic\": \"AI automation\""}
EOF
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"social calendar generator","source":"README.md","quote":"Social content calendar generator","source_quote":"Social content calendar generator","input":"AI automation linkedin,twitter 7","expected":"JSON calendar for the topic","probe_kind":"cli","argv":["python3","scripts/social_calendar.py","AI automation","linkedin,twitter","7"],"expected_text":"\"topic\": \"AI automation\"","cwd":"<guest-path>"},
{"kind":"claim","claim":"automated page analysis","source":"README.md","quote":"automated page analysis, competitor scanning","input":"https://example.com","expected":"SEO analysis with title Example Domain","probe_kind":"cli","argv":["python3","scripts/analyze_page.py","https://example.com"],"expected_text":"\"title\": \"Example Domain\"","cwd":"<guest-path>"}]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"Entry points inspected (install.sh, scripts/*.py, README.md): no cron, scheduler, loop, --once/--now, or webhook trigger. Product is run on demand via Claude Code /market commands and scripts run once per invocation.","checks":[]}
EOF
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"Generate a social media content calendar from the CLI","source":"scripts/social_calendar.py usage","input":"AI automation linkedin,twitter,instagram 30","expected":"30-day calendar JSON for the topic","argv":["python3","scripts/social_calendar.py","AI automation","linkedin,twitter,instagram","30"],"cwd":"<guest-path>","expected_text":"\"duration_days\": 30"}]
EOF
python3 -I -c 'import json;[json.load(open(f".coldpass/{n}.json")) for n in ["probe","claims","cycles","examples"]];print("json ok")'
cd <guest-path> && cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"social calendar generator","source":"Social content calendar generator","input":"AI automation linkedin,twitter 7","expected":"JSON calendar for the topic","probe_kind":"cli","argv":["python3","scripts/social_calendar.py","AI automation","linkedin,twitter","7"],"expected_text":"\"topic\": \"AI automation\"","cwd":"<guest-path>"},
{"kind":"claim","claim":"automated page analysis","source":"automated page analysis, competitor scanning","input":"https://example.com","expected":"SEO analysis with title Example Domain","probe_kind":"cli","argv":["python3","scripts/analyze_page.py","https://example.com"],"expected_text":"\"title\": \"Example Domain\"","cwd":"<guest-path>"}]
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -60; echo "exit=${PIPESTATUS[0]}"
cd <guest-path> && rm -rf <guest-path> && cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Install the AI Marketing Suite skills with the README installer, then run the documented Python CLIs (social calendar generator and page analyzer)","operation_scope":"Linux Ubuntu guest, Python 3.12.3 standard library only (no reportlab, no Claude Code runtime). /market slash commands are Claude Code skills and were not exercised because Claude Code is not installed in the guest; the CLI scripts were exercised directly. analyze_page.py needs outbound HTTPS to the target site.","steps":["curl -fsSL https://raw.githubusercontent.com/zubair-trabzada/ai-marketing-claude/main/install.sh | bash  (replaced by the local ./install.sh from the pinned checkout, which is the README's Manual Install step)","./install.sh (exit 0; installed 14 skills, 5 agents, 4 scripts, 6 templates to ~/.claude)","python3 scripts/social_calendar.py 'AI automation' linkedin,twitter 7 (exit 0, 7-day calendar JSON)","python3 scripts/analyze_page.py https://example.com (exit 0, SEO analysis with title Example Domain)"],"deviations":["Used the local copy of install.sh from the pinned checkout instead of the curl|bash one-liner; the script itself was run as documented and was non-interactive (stdin from /dev/null).","install.sh printed literal \\x1b color escape sequences in its summary (cosmetic only; it does not affect install success).","Did not install the optional reportlab package, so generate_pdf_report.py (report-pdf) was not run.","The /market commands (audit, copy, etc.) run inside Claude Code and were not exercised; Claude Code is not present in the VM.","The checker path was <guest-path> because /inputs/coldpass-preflight.py does not exist in this guest."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"None required for the scripted operations. For full use, install Claude Code and run /market commands; install reportlab for PDF output."}
EOF
python3 -I -c 'import json;json.load(open(".coldpass/report.json"));print("report ok")'; <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | python3 -c 'import json,sys; d=json.load(sys.stdin); print(d["valid"], d["problems"], d["replay"]["status"])'; ls .coldpass