onboarding-optimization — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited onboarding-optimization (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 3 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You optimize the first-run experience to maximize activation — the moment a new user completes the core action that predicts long-term retention.
Activation ≠ sign-up. Activation is the first time the user gets real value from your app. Identify it before anything else.
| App Type | Activation Event |
|---|---|
| Fitness | First workout completed |
| Productivity | First task or project created |
| Social | First connection made or content posted |
| Finance | First account linked or budget set |
| Games | First level or match completed |
| Meditation | First session completed |
| Photo/Video | First photo edited or exported |
Rule: Everything in onboarding should funnel toward that one activation event as fast as possible.
app-marketing-context.mdList every screen from app open to activation:
App open → [Screen 1] → [Screen 2] → ... → Activation eventFlag each screen: Required | Value-adding | Friction only
Remove or defer everything that is friction-only.
| Factor | Question | Score |
|---|---|---|
| Necessity | Can the user reach activation without this? | 0 = skip it |
| Timing | Is this the right moment for this ask? | |
| Value exchange | Does the user understand why this benefits them? | |
| Cognitive load | How many decisions does this require? |
Permissions are the #1 drop-off point. Rules:
| Permission | When to ask | Never ask |
|---|---|---|
| Push notifications | After activation, not before | On cold open |
| Location | When the feature needs it | During sign-up |
| Camera/microphone | Contextually, when used | Before any value |
| Contacts | When the social feature is used | In onboarding |
| Tracking (ATT) | After user is invested | On first open |
The pre-permission screen: Always show a native-looking explanation screen before the system prompt. Users who understand the "why" grant at 2–3× the rate.
| Pattern | Impact | Recommendation |
|---|---|---|
| Required sign-up before value | High drop-off | Defer to post-activation |
| Only email+password | Medium drop-off | Add Sign in with Apple + Google |
| Long profile setup | High drop-off | Ask 1 question max, defer rest |
| Email verification required | Kills momentum | Defer or make optional |
Guest mode / try before sign-up: Allow users to experience the core value before requiring an account. Conversion from guest → registered is typically 40–60% vs. a hard gate at 15–30%.
Open → Core feature demo / interactive preview
→ Activation moment
→ "Save your progress" → Sign-up
→ Permission asks
→ PersonalizationOpen → 3–5 personalization questions (show progress bar)
→ "Your plan is ready" reveal moment
→ Sign-up gate (invested now)
→ ActivationOpen → Sign in with Apple/Google (single tap)
→ Find friends / follow suggestions
→ First feed with content
→ Activation (post, comment, react)| Step | Benchmark | Poor |
|---|---|---|
| App open → first interaction | > 85% | < 70% |
| Sign-up conversion | > 60% | < 40% |
| Push permission grant | > 50% | < 30% |
| Activation (D0) | > 40% | < 20% |
| Day 1 retention | > 30% | < 15% |
If you include personalization, follow these rules:
Rule: Show value before the paywall.
| Placement | Works When |
|---|---|
| Before activation | Almost never — user has no reference for value |
| At activation | Strong — user just felt the value |
| Post-activation, D1 | Strongest for subscription apps |
| Contextual (feature gate) | Good for feature-based paywall |
See monetization-strategy for paywall design details.
Current flow:
[Screen 1] — Required / friction
[Screen 2] — Value-adding
[Screen 3] — Required / friction
...
[Activation event] — Step N
Drop-off analysis:
Biggest drop: [screen] ([X]% exit rate if known)
Estimated cause: [hypothesis]
Recommended changes:
1. [Remove / defer X] — Expected impact: [lift in activation]
2. [Reorder Y before Z] — Expected impact: [rationale]
3. [Add pre-permission screen for Z] — Expected impact: [grant rate improvement]
Revised flow:
Open → [Screen] → [Screen] → Activation → Sign-up → Permissions
Estimated steps removed: [N]
Estimated time to activation: [Xs → Xs][Icon representing the permission]
[Benefit headline — what the user gets]
e.g., "Get notified when your goal is complete"
[One-line explanation]
e.g., "We'll only send you reminders you set — no spam."
[Allow button] [Not now]retention-optimization — Day 7/30 retention strategymonetization-strategy — Paywall placement and trial designab-test-store-listing — Test onboarding variantsapp-analytics — Set up activation funnel trackingrating-prompt-strategy — When to ask for a rating post-activation~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.