Ops Marketing

What it does

When your agent uses it

• Asks to klaviyo
• Tasks that involve Email marketing

Example prompts

• “klaviyo”
• “ads spend”
• “/ops-marketing”

Requirements

• A credential in CLOUDFLARE_API_TOKEN
• A credential in CLOUDFLARE_API_KEY
• Pre-approved tools (allowed-tools): Bash, Read, Write, Grep, Glob, Agent, TeamCreate, SendMessage, AskUserQuestion, WebFetch, WebSearch

Workflow steps

4 steps, taken from the first numbered list in SKILL.md.

1. 1ops-marketing-provision status --project — what's missing
2. 2For each missing channel, run ops-marketing-provision provision- --project (interactive only if OAuth/keys missing; otherwise idempotent)
3. 3Verify with ops-marketing-dash --project
4. 4If autopilot not yet enabled, enable: ops-marketing-autopilot --project --first-run-dry

What it can do on your machine

Read from SKILL.md and the folder at commit 996d61a. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves these tools, so the agent can use them without asking each time:

  • Bash
  • Read
  • Write
  • Grep
  • Glob
  • Agent
  • TeamCreate
  • SendMessage
  • AskUserQuestion
  • WebFetch

  …and 1 more on the same allowed-tools line.

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  No scripts in the folder and no shell commands in SKILL.md (its code samples are bash and jsonc).

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  Links to these hosts (documentation or services it may open):

  • ads.google.com

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names these keys or tokens, usually read from environment variables:

  • CLOUDFLARE_API_TOKEN
  • CLOUDFLARE_API_KEY
  • KLAVIYO_API_KEY
  • RESEND_API_KEY
  • STRIPE_SECRET_KEY
  • STRIPE_API_KEY
  • META_ACCESS_TOKEN

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Ops Marketing loads about 3.5k tokens when it runs, and up to ~38k if it reads all its reference files. Until then it costs about 26 tokens; SKILL.md has 783 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~26

When it runs · the whole SKILL.md, loaded when a task matches

~3.5k

With references · SKILL.md plus every file in references/, read only if the agent opens them

~38k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

• NotePre-approves every shell command (allowed-tools: Bash)SKILL.md

  allowed-tools: Bash, Read, Write, Grep, Glob, Agent, TeamCreate, SendMessage, AskUserQuestion, WebFetch, WebSearch

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from Lifecycle-Innovations-Limited/claude-ops at commit 996d61a, republished under its MIT licence (© Lifecycle-Innovations-Limited). 783 words, ~3,504 tokens.

name

ops-marketing

description

OPS on-demand: This skill should be used when the user asks to "klaviyo", "ads spend", or…

allowed-tools

Bash, Read, Write, Grep, Glob, Agent, TeamCreate, SendMessage, AskUserQuestion, WebFetch, WebSearch

argument-hint

<project> [email|ads|analytics|seo|social|campaigns|setup|autopilot ...]

effort

medium

maxTurns

40

context

fork

{
  "marketing": {
    "projects": {
      "myapp": {
        "domain": "example.com",

        // Outbound email service provider (DKIM + SPF includes)
        "esp": {
          "provider": "resend", // "resend" | "postmark" | "ses"
          "credentials": "doppler:prd:RESEND_API_KEY", // cred-ref: "env:VAR" | "doppler:CFG:KEY"
          "spf_includes": ["_spf.resend.com", "_spf.klaviyo.com"], // optional; sensible defaults applied
          "spf_policy": "-all", // "-all" (strict) | "~all" (soft-fail)
        },

        // Inbound mail (MX)
        "inbound": {
          "provider": "google-workspace", // "google-workspace" | "resend-inbound" | "ses"
          "region": "us-east-1", // only used by resend-inbound / ses
        },

        // DMARC policy
        "dmarc": {
          "policy": "quarantine", // "none" | "quarantine" | "reject"
          "rua": "mailto:dmarc@example.com", // defaults to mailto:dmarc@<apex>
        },

        // Optional Cloudflare account override (for accounts that own multiple zones)
        "dns": {
          "cloudflare_account_id": "<your-cf-account-id>",
        },

        // Apple Pay domain registration
        "apple_pay": {
          "enabled": true,
          "mode": "static-file", // default; "stripe-dns" registers via Stripe
        },

        // Cred-refs for individual rows
        "stripe": {
          "secret_key": "env:STRIPE_SECRET_KEY", // legacy DNS provisioner key
          "api_key": "env:STRIPE_API_KEY", // P3: used by ops-marketing-autopilot stripe ROAS gate
          "account_id": "acct_<id>", // optional, only when calling on behalf of a connected acct
        },
        "meta": { "access_token": "env:META_ACCESS_TOKEN" },
        "klaviyo": {
          "private_key": "doppler:prd:KLAVIYO_API_KEY", // legacy DNS row
          "api_key": "doppler:prd:KLAVIYO_API_KEY", // P3: used by gather_klaviyo_metrics
          "account_id": "<klaviyo-account-id>", // P3: optional
          "sending_subdomain": "em.example.com",
        },
      },
    },
  },
}

# Dry-run every row for a project
OPS_DRY_RUN=1 ops-dns-provision provision-all myapp

# Single row, ad-hoc domain (no prefs needed)
ops-dns-provision dmarc myapp example.com

# JSON audit for CI healthcheck
ops-dns-provision audit myapp --json
# → {"project":"myapp","domain":"example.com","zone":"...","rows":{"gsc":"present","spf":"present","dmarc":"present","mx":"present","meta_aem":"absent","dkim":"unknown"}}

# Skip rows that need provider-specific manual setup first
ops-dns-provision provision-all myapp --skip dkim,klaviyo-sending

# One-shot: GA4 + GSC + Instagram + Google Ads — sequential, idempotent
ops-marketing-provision provision-all --project <project>

# Iterate every project in prefs
ops-marketing-provision provision-all --all-projects

# Or individually:
ops-marketing-provision provision-ga4         --project <project> \
  --domain <domain> --account-id <YOUR_GA4_ACCOUNT_ID>
ops-marketing-provision provision-gsc         --project <project> --site https://<domain>/
ops-marketing-provision provision-instagram   --project <project>   # auto-resolves via Meta token
ops-marketing-provision provision-google-ads  --project <project>   # 4-step OAuth flow

# Check results
ops-marketing-provision status --project <project> --json
ops-marketing-dash --project <project>

© Lifecycle-Innovations-Limited, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 1 other file (references) in claude-ops/skills/ops-marketing of Lifecycle-Innovations-Limited/claude-ops.

• SKILL.md
• references/details.md

Open the folder on GitHubat commit 996d61a