GTM agent for technical founders. Pay-per-result. Two surfaces: terminal CLI + local web dashboard.
# Add to your Claude Code skills
git clone https://github.com/oneshot-agent/oneshot-gtmLast scanned: 6/16/2026
{
"issues": [
{
"file": "README.md",
"line": 56,
"type": "secret-exfiltration",
"message": "Instruction appears to send credentials/secrets to an external endpoint",
"severity": "medium"
},
{
"file": "README.md",
"line": 108,
"type": "remote-install",
"message": "Install command (remote install script piped to a shell — review the source before running): \"curl -fsSL https://bun.sh/install | bash\"",
"severity": "low"
}
],
"status": "PASSED",
"scannedAt": "2026-06-16T09:26:43.809Z",
"npmAuditRan": false,
"pipAuditRan": true,
"promptInjectionRan": true
}See how oneshot-gtm compares with popular alternatives.
oneshot-gtm is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by oneshot-agent. GTM agent for technical founders. Pay-per-result. Two surfaces: terminal CLI + local web dashboard. It has 672 GitHub stars.
Yes. oneshot-gtm passed SkillsLLM's automated security scan — a dependency vulnerability audit plus prompt-injection heuristics — with no high-severity issues. You can read the full report in the Security Report section on this page.
Clone the repository with "git clone https://github.com/oneshot-agent/oneshot-gtm" and add it to your Claude Code skills directory (see the Installation section above).
oneshot-gtm is primarily written in TypeScript. It is open-source under oneshot-agent on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh oneshot-gtm against similar tools.
No comments yet. Be the first to share your thoughts!
From $49 · 30 days · terms & refunds
⚠️ Third-Party Software Notice
This skill is third-party open-source software developed and hosted independently on GitHub. SkillsLLM is an informational directory and does not control or maintain the underlying repository.
Any security checks, ratings, or warnings displayed by SkillsLLM are automated and limited in scope. They do not constitute a security certification or guarantee that the software is safe, error-free, or free from malicious code, vulnerabilities, compromised dependencies, or prompt-injection risks.
Review the source code, permissions, dependencies, and configuration before installing or running any third-party skill. Use is at your own risk. To the maximum extent permitted by applicable law, SkillsLLM is not liable for losses arising from third-party software.
Automated security scan — not a certification.
Outbound for founders who have not earned scale yet. It finds people, you approve them, it writes, you send.
oneshot-gtm.com · docs · what a signed receipt is
bunx oneshot-gtm-server # the dashboard, no clone
https://github.com/user-attachments/assets/d4c3a6b1-2850-481c-bb78-9d3cec940ea5
Every paid call leaves a signed receipt, so spend per reply is a record and not an estimate.
It runs on your machine: a CLI and a local dashboard over one SQLite ledger. OneShot supplies the actions (research, enrichment, email, LinkedIn, SMS, voice, letters) and bills per call. You bring the LLM key. The licence is MIT. Read the prompts, fork the plays.
Most outbound tools assume product-market fit and optimise sends. Most founders using them do not have it yet. So the limits are in the code.
handoff commands check your replies and deals before a scale move, and say so when it is too early.curl -fsSL https://bun.sh/install | bash # Bun is the runtime
git clone https://github.com/oneshot-agent/oneshot-gtm
cd oneshot-gtm && bun install
bun run cli -- init # profile and keys
bun run cli -- doctor # health check
bun run --cwd apps/web build # build the dashboard once
bun run cli -- ui # http://127.0.0.1:3030
init asks who you are and what you sell. Every field is optional: a blank one skips its beat in the draft, it is never invented. Your first workspace walks the dashboard path from an empty install to a reviewed draft. Prompt inputs maps each field to the drafts it reaches, and a voice card makes them sound like you.
bunx oneshot-gtm-server runs the dashboard without a clone. Both paths need Bun; the code uses bun:sqlite and fails under plain Node. bun run cli -- --help lists every command, and the CLI reference documents each flag.
A finder is a source with a schedule and a spend cap: Show HN, funding news, accelerator cohorts, job changes, open roles, GitHub stars, event guest lists, business registries, public tenders, any page that lists companies. All of them start off. Turn on the ones your buyers show up in, apply an industry pack, or bring your own list. Finders has the table, the gates and the research each row gets.
A play is one motion: who it is for, what happened to them, what the first message says and how it follows up. Pick by the buyer's situation. Email and LinkedIn go out when you send. X, Reddit and Hacker News drafts are posted by you, then marked sent. Choosing a play lists each one with what it needs and what it produces.
Mail goes out through a pool of your own mailboxes and OneShot domains. A prospect always hears from the address that wrote first. Sending has the caps, the duplicate guard and reply handling.
Connect your account once on Setup. Invites, messages and replies go through OneShot's API from that account, never a browser bot. Notes and messages are your templates with each person's details filled in. LinkedIn has the templates, the limits and the guard that runs before each invite.
A physical letter as an optional cadence step. Each one is proofed and approved by hand; no bulk action sends mail. See direct mail.
Finders poll while the dashboard runs. ui --install-service keeps it running across restarts, and config spend-ceiling caps what a day of finder runs and drains may spend. See background monitoring.
One workspace is one product: one voice, one ICP, one ledger, one sender pool. A second product gets a second workspace.
bun run cli -- workspace create acme
bun run cli -- --workspace acme init
bun run cli -- --workspace acme ui
Workspaces share one database of people, paid lookups and contact history, so two products do not cold-email the same person in the same week. See workspaces.
apps/cli apps/server apps/web surfaces
commander Bun.serve + SSE Vite + React
\ | /
packages/* core · intel · plays · find · prompts · doctor · shared-types
|
@oneshot-agent/sdk email · LinkedIn · SMS · voice · research · enrichment · receipts
~/.oneshot-gtm/ledger.sqlite is the source of truth for the CLI and the dashboard. ONESHOT_GTM_HOME moves it. Data storage lists every file and how to back it up.~/.oneshot-gtm/.env, mode 600.127.0.0.1. The only routes meant for other systems are two webhooks.async/await throughout.What stays out of Git is in repository boundaries.
bun install
bun run typecheck # tsc across apps and packages
bun run lint # oxlint
bun run fmt # oxfmt, also formats Markdown
bun --bun run test # vitest under Bun
bun run --cwd apps/web build # apps/web/dist
bun run --cwd apps/server build # the published server bundle
The --bun flag matters: bun:sqlite does not exist under Node. Tests set ONESHOT_GTM_HOME to a temp directory and never touch your ledger. STATUS.md carries the current test totals. Docs upkeep is in maintaining the docs.
Each install writes ~/.oneshot-gtm/events.jsonl: one line per LLM call, gate decision, finder event and swallowed error. It never leaves the machine.
tail -F ~/.oneshot-gtm/events.jsonl | jq -c '{t:.ts, k:.kind, ctx:.ctx}' # everything, condensed
tail -F ~/.oneshot-gtm/events.jsonl | jq -c 'select(.kind|startswith("llm."))' # LLM calls
tail -F ~/.oneshot-gtm/events.jsonl | jq -c 'select(.kind=="icp.decision")' # topic gate
tail -F ~/.oneshot-gtm/events.jsonl | jq -c 'select(.kind=="icp.person_decision")' # person gate
tail -F ~/.oneshot-gtm/events.jsonl | jq -c 'select(.level=="error" or .level=="warn")'
DEBUG=oneshot:* oneshot-gtm find watch --once # mirror to stderr
The file rotates at about 10 MB into three older generations. Use tail -F; tail -f loses the file at rotation.
Anonymous and on by default. One command turns it off:
oneshot-gtm config telemetry off # or ONESHOT_GTM_TELEMETRY=0
It sends one event per command: the command name, flag names, outcome, duration, versions, OS, LLM provider and a random install id. Nothing about prospects, prompts, replies, receipts or your wallet. TELEMETRY.md is the field list.
STATUS.md says what is verified against the live API and what is thin. ROADMAP.md says what is not built and what never will be: it will not run an SDR for you, manage your DNS, hold your customer data, lock you to one LLM or go multi-user.
MIT. See LICENSE. Shipped something with it? There is a badge.
Built by free.butter. The lead pipeline behind it runs there.