CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

30.8 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 1 flagged

Securityscore 88 · 1 finding

MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · skills/community-builder/rules/programs-ambassador-champion.md

MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.

Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted

excerptskills/community-builder/rules/programs-ambassador-champion.md· markdown

363- **Heavy-handed requirements** — Mandate specific activities, kill authenticity

364- **Poor offboarding** — Inactive ambassadors stay, program credibility suffers

365- **No feedback loop** — Don't ask ambassadors what they want

Occurrences

1 occurrence · at L365

How to fix

Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.

Delete blanket "don't ask / no need to confirm" directives from the skill.
If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-DONT-ASK-01sha25615dae9807bd892c6…rubric 365aacaView on GitHub

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/community-builder/SKILL.md · 1 file

skills/community-builder/SKILL.md6.9 KB · Markdown

name: community-builder

description: Expert community-led growth and community management guidance. Use when building developer communities, Discord/Slack communities, online communities, managing community platforms, designing member onboarding, creating engagement programs, running ambassador programs, measuring community health, setting up moderation systems, or implementing DevRel strategies. Use for community-led growth, member activation, user-generated content programs, and community governance.

Community Builder

Expert guidance for building, growing, and nurturing thriving online communities — from platform selection to engagement programs to community-led growth strategies.

Philosophy

Great communities are built on three pillars:

Shared purpose — Members need a reason bigger than the product
Genuine connection — People stay for people, not features
Member empowerment — The best communities run themselves

How This Skill Works

When invoked, apply the guidelines in rules/ organized by:

strategy-* — Community-led growth, positioning, and strategic planning
platform-* — Discord, Slack, Circle, and platform selection
onboarding-* — Member welcome flows and activation
engagement-* — Programs, rituals, and recurring activities
content-* — User-generated content and content programs
programs-* — Ambassador, champion, and super-user programs
metrics-* — Community health and analytics
moderation-* — Governance, moderation, and conflict resolution
devrel-* — Developer relations and technical community building

Core Frameworks

The Community Flywheel

┌─────────────────────────────────────────────────────────────┐
│                                                             │
│   ┌──────────┐    ┌──────────┐    ┌──────────┐             │
│   │  ATTRACT │───▶│ ACTIVATE │───▶│  ENGAGE  │             │
│   │ (Reach)  │    │ (Value)  │    │ (Habit)  │             │
│   └──────────┘    └──────────┘    └──────────┘             │
│        ▲                                │                   │
│        │          ┌──────────┐          │                   │
│        │          │ ADVOCATE │          │                   │
│        └──────────│ (Amplify)│◀─────────┘                   │
│                   └──────────┘                              │
│                                                             │
└─────────────────────────────────────────────────────────────┘

Community Maturity Model

Stage	Characteristics	Focus
Nascent	Founder-led, <100 members	1:1 conversations, manual everything
Growing	Early champions emerge, 100-1,000	Systems, rituals, first programs
Scaling	Self-sustaining activity, 1,000-10,000	Governance, moderation, delegation
Mature	Community-led initiatives, 10,000+	Platform, sub-communities, ecosystem

Member Journey Stages

Stage	Goal	Key Metric
Lurker	First interaction	Post/reply count
Newcomer	Find value, connect	Retention D7
Regular	Form habits, contribute	Weekly active
Champion	Lead initiatives	Content created
Ambassador	Represent externally	Referrals, reach

The 1-9-90 Rule

In most communities:

1% create content (Creators)
9% engage with content (Contributors)
90% consume content (Lurkers)

Goal: Move people up the engagement ladder, not force everyone to create.

Community vs Audience

Dimension	Audience	Community
Direction	One to many	Many to many
Value	From creator	From each other
Ownership	Creator owns	Members co-own
Content	Creator produces	Members produce
Retention	Content-dependent	Relationship-dependent
Scalability	Linear	Network effects

Platform Comparison at a Glance

Platform	Best For	Key Strength	Key Weakness
Discord	Gaming, dev, real-time	Rich features, free	Overwhelming UX
Slack	Professional, B2B	Familiar, searchable	Expensive at scale
Circle	Courses, creators	Clean UX, courses	Less real-time
Discourse	Long-form, async	SEO, knowledge base	Old-school feel
GitHub Discussions	Open source, devs	Code integration	Limited features
Reddit	Public discovery	SEO, scale	Less control

Key Metrics Overview

Category	Metrics
Growth	New members, referral rate, churn rate
Engagement	DAU/MAU, posts per member, response time
Health	Sentiment, helpful answers, retention
Value	NPS, support deflection, product influence

Community-Led Growth (CLG) Quick Reference

Motion	Description	Best For
Community-Assisted	Community supports product users	Support deflection
Community-Qualified	Leads emerge from community	B2B, enterprise
Community-Distributed	Growth through member networks	Viral products
Community-Created	Members build on platform	Platforms, APIs

Engagement Program Types

Program	Frequency	Goal
Office Hours	Weekly	Direct access, Q&A
Show & Tell	Weekly/Monthly	Member showcases
AMAs	Monthly	Expert access
Challenges	Monthly/Quarterly	Activation, content
Conferences	Annual	Milestone, celebration

Anti-Patterns

Build it and they will come — Communities require constant nurturing, especially early
Metrics over meaning — Vanity metrics don't equal healthy community
Over-engineering early — Start simple, add complexity as needed
Ignoring lurkers — 90% of your community provides value by consuming
Founder absence — Early communities need visible leadership
Feature obsession — People join for people, not features
Forced engagement — Authentic connection beats gamification
One-size-fits-all — Different member types need different experiences
Scaling too fast — Growth without engagement destroys community
Neglecting moderation — One bad actor can poison the well

community-builder— agent skill

Is community-builder safe to install?

Community Builder

Philosophy

How This Skill Works

Core Frameworks

The Community Flywheel

Community Maturity Model

Member Journey Stages

The 1-9-90 Rule

Community vs Audience

Platform Comparison at a Glance

Key Metrics Overview

Community-Led Growth (CLG) Quick Reference

Engagement Program Types

Anti-Patterns

Audit the pieces. Scan the whole. Decide.