smb-onboard-a763ff — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited smb-onboard-a763ff (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Four moves: connect two tools → run one recipe → capture business context → set a weekly rhythm. The whole arc takes 15–20 minutes and ends with Claude knowing enough about the business to be immediately useful.
User: "get me started"
→ Assess what's already connected; pick the best 2 tools to connect first
→ Guide connection of each tool (one at a time)
→ Run one recipe against live data to prove value
→ Ask 5 business questions one at a time; store answers to persistent memory
→ "Each Monday, say 'weekly check-in' — I'll pull your numbers and flag anything urgent."Whenever a connector comes up — recommending one, naming what to try next, or clarifying mid-flow — describe what Claude will be able to do once it's connected, not what the platform itself is or sells. Owners already know what HubSpot, QuickBooks, Gmail, and Calendar do; they don't need a product pitch from us.
## Business context block already exists in the owner's CLAUDE.md or memory, read it first — then skip to the return-session path: show the existing profile, ask what's changed, update only the fields that changed. Do not re-interview from scratch.Name the two functions we want (e.g. "a place to track customers and deals" and "your inbox") — not the platform features. One short sentence each, max. Then ask whether the owner uses a supported tool for each.
For each function, branch:
Connect one tool at a time — never ask the owner to configure two simultaneously. See reference/gotchas.md for the failure pattern this replaces.
## Business context using the exact format in reference/onboard-checklist.md. If a memory file already exists, update only the ## Business context section — do not touch other content. Confirm: "Saved. Every skill from here will know your business."## Business context block already exists, show current vs. proposed before writing any changes.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.