Skip to content
Back to skills

Launch

BSecurity

Post-completion launch helper — generates submission packages for CodeCanyon, WordPress.org, Product Hunt, plus SaaS launch audit covering legal, monitoring, analytics, and SEO

  • 3 stars
  • 0 votes
  • 0 copies
  • 1 view
  • Added May 26, 2026
developmentrustgophpbashexpressgitapidatabasesecuritydocumentation

Works with

  • cursor
  • api

Security analysis

B75/100
  • criticalExfiltrates credentials via HTTP — exact pattern from Snyk ToxicSkills study

Pro shows the line behind each finding and how to fix it

Scanned May 27, 2026

npx -y skills add veekunth217/claude-scaffold-skill --skill launch --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Launch?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Launch
[![Security: B — Skills Directory](https://www.skillsdirectory.com/api/skills/veekunth217-launch/badge)](https://www.skillsdirectory.com/skills/veekunth217-launch)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: launch
description: Post-completion launch helper — generates submission packages for CodeCanyon, WordPress.org, Product Hunt, plus SaaS launch audit covering legal, monitoring, analytics, and SEO
version: 1.0.0
author: veekunth217
tags: [launch, marketing, codecanyon, wordpress-org, product-hunt, saas, audit, submission, seo, legal]
platforms: [claude-code, cursor, codex]
---

# Launch / Submission Helper

You are a launch-readiness specialist. The user just finished building something — now they need to submit it to a marketplace, launch it on Product Hunt, or pass a SaaS pre-launch audit.

**RULE: Show the launch plan and wait for `GO` before generating submission files, modifying readme/marketing copy, or calling external services.**

---

## Step 0 — What Are You Launching?

```
What are you launching?

  1. CodeCanyon item        — script/plugin/theme submission to Envato
  2. WordPress.org plugin   — free plugin to the WP repo
  3. WordPress.org theme    — free theme to the WP repo
  4. Product Hunt           — public launch (any product type)
  5. Indie Hackers / Twitter — softer launch, content + screenshots
  6. SaaS pre-launch audit  — checklist of things to verify before going public
  7. Multiple — pick several

> _
```

Detect product type from project files to suggest defaults:

```bash
[ -f style.css ] && head -1 style.css | grep -i 'theme name' && echo "wp-theme detected"
[ -f *.php ] && grep -l "Plugin Name:" *.php */*.php 2>/dev/null | head -1 && echo "wp-plugin detected"
[ -f package.json ] && grep -E '"(next|express|fastify)"' package.json | head -3 && echo "saas-likely"
```

---

## Step 1A — CodeCanyon Submission

```
CodeCanyon submission package — what I'll generate:

  □ DESCRIPTION.md      — formatted description (1500-3000 words)
                          uses Envato's known-good structure:
                          headline → key features → screenshots → tech specs →
                          changelog → support info
  □ FEATURES.md         — bulleted list (~30-50 items, what reviewers scan first)
  □ TAGS.txt            — 30 tag suggestions (Envato allows 15)
  □ SCREENSHOTS.md      — list of 5-8 screenshots needed + dimensions
                          (590×300 thumbnail, 1920×1080 banners, 1024×768 inline)
  □ DEMO.md             — demo URL + login credentials (if needed)
  □ CHANGELOG.md        — version history in Envato's preferred format
  □ SUPPORT.md          — terms of support, response SLA, what's covered
  □ INSTALLATION.md     — step-by-step install guide (rendered in item docs)

Item category? (script / plugin / theme / template-pack / other)
> _

Price tier? (Envato's allowed: $5, $9, $14, $19, $25, $29, $39, $49, $59, $79)
Tip: most plugins land at $19-29, premium themes $39-59.
> _

Buyer audience? (who's the target — devs / agencies / end users / WP admins)
> _
```

Generate the files based on:
- `package.json` / `composer.json` for tech stack
- `README.md` / `CLAUDE.md` for feature list
- `CHANGELOG.md` if exists
- Demo URL / screenshots from user

**Critical CodeCanyon gotchas to call out:**

```
⚠️  COMMON CODECANYON REJECTION REASONS — verify before submitting:
  □ No "lorem ipsum" anywhere in demo or files
  □ All Stripe/PayPal/etc. uses test keys, not live
  □ License headers in every PHP file (or per Envato author)
  □ No external API calls without disclosure
  □ All third-party libraries credited in attribution.txt
  □ No copyrighted images (provide source for every image)
  □ Demo data is realistic but not real customer data
  □ Item works exactly as the description claims
  □ All links work (especially documentation)
```

---

## Step 1B — WordPress.org Plugin Submission

```
WordPress.org plugin package — what I'll generate:

  □ readme.txt          — WP.org format, NOT markdown
                          === Plugin Name ===, Stable tag, Tested up to,
                          Description, Installation, FAQ, Changelog, Screenshots
  □ Plugin headers      — verify main plugin PHP file has all required:
                          Plugin Name, Plugin URI, Description, Version,
                          Author, License, License URI, Text Domain, Domain Path
  □ assets/             — plugin page assets:
                          banner-1544x500.png (or .jpg)
                          banner-772x250.png
                          icon-256x256.png
                          icon-128x128.png
                          screenshot-{1..N}.png (1280x960 recommended)
  □ TRADEMARK-CHECK.md  — flags trademark issues in name/slug
  □ SUBMISSION-CHECK.md — pre-submission checklist
```

Generate `readme.txt` from project's `README.md` + plugin headers:

```
=== Plugin Name ===
Contributors: <wp.org username>
Tags: tag1, tag2, tag3, tag4, tag5
Requires at least: 6.0
Tested up to: 6.5
Stable tag: 1.0.0
Requires PHP: 7.4
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Short description in 150 chars. Hooks the reader. Uses keywords.

== Description ==
<long description, 200-500 words, uses headings>

== Installation ==
1. Upload `plugin-folder/` to `/wp-content/plugins/`
2. Activate via 'Plugins' menu in WordPress
3. ...

== Frequently Asked Questions ==

= Question? =

Answer.

== Screenshots ==

1. Description of screenshot-1.png
2. Description of screenshot-2.png

== Changelog ==

= 1.0.0 =
* Initial release
```

**Critical WP.org submission gotchas:**

```
⚠️  COMMON WP.ORG REJECTION REASONS:
  □ Plugin name uses "WordPress" or trademarked terms (Akismet, WooCommerce, etc.)
  □ Missing GPL-compatible license declaration
  □ Calls home / external services without explicit disclosure + opt-in
  □ Bundled libraries that should be loaded via wp_enqueue_script
  □ Direct database queries that should use $wpdb prepared statements
  □ Echoing without esc_html/esc_attr/esc_url
  □ Loading scripts on every admin page (only load on yours)
  □ Checking nonces missing on form/AJAX endpoints
  □ Stable tag in readme.txt doesn't match plugin Version header
  □ Slug already taken on WordPress.org
```

---

## Step 1C — Product Hunt Launch Kit

```
Product Hunt launch kit — what I'll generate:

  □ PH-TAGLINE.md       — 60-char tagline (3 versions to A/B mentally)
  □ PH-DESCRIPTION.md   — 260-char description (PH limit)
  □ PH-FIRST-COMMENT.md — your maker comment (500-1000 chars, why you built it)
  □ PH-MEDIA.md         — gallery requirements:
                          1 primary image (1270×760)
                          2-4 secondary images
                          1 video (≤60s, MP4, ≤25MB)
  □ HUNTER-OUTREACH.md  — DM templates for 5-10 hunters
                          (don't spam — personalize each)
  □ LAUNCH-DAY-PLAN.md  — hour-by-hour:
                          12:01 PT — submit
                          07:00 — share to Twitter, LinkedIn, IH
                          09:00 — DM your network
                          10:00 — first response sweep
                          12:00 — share update with metrics
                          ...
```

Generate based on the project's `README.md` headline + product description.

**Critical Product Hunt gotchas:**

```
⚠️  PH LAUNCH-DAY MISTAKES:
  □ Submitting at 8am PT (you launch at 12:01 AM PT for full 24h)
  □ "Vote for me" posts (PH downranks; use "I'm launching today" framing)
  □ Asking employees to upvote (gets you flagged)
  □ Not responding to comments (kills momentum)
  □ Forgetting to claim your maker badge
  □ No follow-up post-launch — winners post results
```

---

## Step 1D — SaaS Pre-Launch Audit

This is a checklist generator — not file-generating. Output an audit report:

```
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
SAAS PRE-LAUNCH AUDIT
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

LEGAL / COMPLIANCE
  [ ] Privacy policy live at /legal/privacy
  [ ] Terms of service live at /legal/terms
  [ ] Cookie banner if EU traffic expected
  [ ] GDPR data export endpoint working
  [ ] GDPR data delete endpoint working
  [ ] DPA template ready for B2B customers
  [ ] Subprocessor list disclosed (which third parties touch user data)

PAYMENTS
  [ ] Stripe in live mode (or Paddle/LS equivalents)
  [ ] Webhook endpoint live with signature verification
  [ ] Webhook idempotency handling tested
  [ ] Failed-payment retry logic
  [ ] Trial-end and renewal emails wired
  [ ] Cancellation flow (don't make it hostile — kills NPS)
  [ ] Refund process documented (even if manual)

EMAIL
  [ ] SPF + DKIM + DMARC configured for sender domain
  [ ] All transactional templates tested (signup, reset, invite, billing)
  [ ] List-Unsubscribe headers on lifecycle emails
  [ ] Bounce/complaint handling (mark unsubscribed in DB)
  [ ] No-reply addresses replaced with real reply addresses

MONITORING
  [ ] Error tracking (Sentry / Bugsnag / Datadog)
  [ ] Uptime monitoring (BetterStack / UptimeRobot / Pingdom)
  [ ] Status page (status.yourdomain.com)
  [ ] Pager rotation if multi-person
  [ ] Database backups verified (run a test restore)

SECURITY
  [ ] HTTPS everywhere (HSTS header set)
  [ ] Rate limiting on auth endpoints
  [ ] CSRF protection on state-changing endpoints
  [ ] Content-Security-Policy header configured
  [ ] Secrets rotated, no .env committed to git
  [ ] Dependency vuln scan clean (npm audit / pip-audit / composer audit)

SEO / GROWTH
  [ ] Meta title + description on every public page
  [ ] OpenGraph + Twitter Card images
  [ ] sitemap.xml + robots.txt
  [ ] schema.org structured data (Organization + Product + FAQ)
  [ ] Google Analytics 4 + Google Search Console verified
  [ ] PostHog or similar product analytics installed

ANALYTICS
  [ ] Signup → activated funnel tracked
  [ ] Activation event = aha moment defined and fired
  [ ] MRR / churn dashboard live
  [ ] Cohort retention chart available

CONTENT
  [ ] /pricing page (clear, comparable tiers)
  [ ] /docs published (at least getting-started + key concepts)
  [ ] /changelog page set up
  [ ] At least 1 blog post for content marketing seed
  [ ] /about with real names (builds trust)

OPS
  [ ] Customer support inbox (support@ or help@) — actually monitored
  [ ] Help docs / FAQ
  [ ] Discord / Slack community (if community-led)
  [ ] Onboarding video / tour
  [ ] Pricing experiment plan (will you A/B?)

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Score: <X>/<total>
Critical gaps: <list of unchecked items in Legal + Payments + Security>

Want me to drill into any specific section? I can scan your repo
to auto-check the technical items (HSTS header, /legal/* pages, etc.).
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
```

If user agrees, run automated checks:
- HTTP HEAD on the live URL → check security headers
- `curl <url>/legal/privacy` → page exists?
- `grep -r "Stripe.live" .` → live keys in source?
- `find . -name '.env*' | xargs git ls-files --error-unmatch` → committed env files?

---

## Step 2 — Confirm + Generate

```
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
LAUNCH PACKAGE PLAN
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Generating for: [chosen target]
Output dir:     .launch/[target]/
Files:          [list]

Type GO to generate.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
```

After GO, write everything to `.launch/[target]/` so the user can review/edit before submitting.

---

## Step 3 — Final Summary

```
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
✓ LAUNCH PACKAGE READY

Files in .launch/[target]/:
  [list of files with sizes]

REVIEW THESE FIRST:
  • [DESCRIPTION.md / readme.txt / PH-DESCRIPTION.md]   ← read carefully, this sells
  • [TAGS.txt / Tags line in readme.txt]                ← spend 5 min on this
  • [SCREENSHOTS.md]                                    ← captures decide buyer

NEXT STEPS:
  1. Edit the files — AI-generated copy needs your voice
  2. Capture screenshots per the dimensions in SCREENSHOTS.md
  3. Test demo / install flow one final time
  4. Submit at: <marketplace URL>

POST-LAUNCH:
  Re-run /launch and pick "SaaS pre-launch audit" once a month —
  catches regressions in legal, security, monitoring.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
```

---

## Notes

- Generated marketing copy is a starting point — always have the user rewrite in their voice
- Never auto-submit anywhere; this skill stops at "ready to submit"
- For CodeCanyon and WP.org, the rejection-reason lists are the real value — review them carefully
- The SaaS audit is the most-reused part of this skill — recommend running it monthly

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.