solo-founder-gtm
When the user is a solo founder building their GTM motion, wants to scale without hiring, or needs to design an AI agent team for go-to-market. Also use when the user mentions 'solo founder,' 'one-person startup,' 'solopreneur,' 'bootstrapped,' 'no team,' 'AI agents as team,' 'scaling without hiring,' 'founder-led sales,' 'lean GTM,' 'one-person company,' or 'no employees.' This skill covers the complete solo founder GTM playbook from stack selection through agent team design, revenue-stage transitions, time allocation, and when to finally hire. Do NOT use for technical implementation, code review, or software architecture.
72
88%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Medium
Suggest reviewing before use
Security
1 medium severity finding. This skill can be installed but you should review these findings before use.
W009: Direct money access capability detected (payment gateways, crypto, banking).
What this means
The skill is specifically designed for direct financial operations, giving the agent the ability to move money or execute financial transactions — such as payment processing, cryptocurrency operations, banking integrations, or market order execution.
Why it was flagged
The skill explicitly names payment gateway tools and payment operations: it recommends Stripe in the core stack ("Payments | Stripe") and later references usage-based billing via Stripe and invoicing/annual invoicing flows. These are specific payment gateway references (tools whose primary purpose is moving money), so the skill contains direct financial execution capability.
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
The skill explicitly instructs deploying a "Research Agent" and "Outreach Agent" that use third-party enrichment tools (Clay, Apollo) and public social platforms (e.g., "DM 20 people per day on X or LinkedIn" and "Identify prospect > Enrich data > ... Pull personalization context") — clearly ingesting untrusted, user-generated web/social content that the agent reads and uses to drive outreach and personalization decisions.
- Repository
- tech-leads-club/agent-skills
- Commit
4beb507
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.