onboard — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited onboard (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
On a fresh clone of the repo, or any time the user explicitly invokes /onboard. Also when the user says things like "I just cloned this", "set me up", "first time", "how do I start".
If the user is mid-task on something else (writing a resume, analyzing a Job Description), do not silently redirect them into onboarding. Confirm first.
$PERSONAL/ directory bootstrapped with career/ and applications/ subfolders.$PERSONAL/career/:personal-info.mdgoals.mdimpact-doc.mdbrag-doc.mdNothing else. No git changes. No app launching. No resume generation.
Run these phases in order. Each phase is resumable: re-running /onboard after partial setup detects what already exists and picks up where the user left off. Confirm before overwriting any file that already has real content (not template stubs).
$PERSONAL and $LEETCODE_BANK per CLAUDE.md (both are siblings of the main repo).$PERSONAL/ exist?$PERSONAL/career/ exist?personal-info.md, goals.md, impact-doc.md, brag-doc.md exist?<!-- comments --> and empty fields) or does it have real content?$LEETCODE_BANK/ exist (for Phase 2.5)? Setup status: $PERSONAL exists, personal-info filled, goals stub, impact-doc and brag-doc missing. $LEETCODE_BANK missing.
Resuming from goals.Run these silently and only report the missing ones. Don't list things that work.
| Check | How | Why it matters |
|---|---|---|
git config user.name and user.email set | git config user.name && git config user.email | Commits and PR authorship. |
pandoc installed | pandoc --version | resume-builder and cover-letter-builder produce .docx. |
python3 installed | python3 --version (Windows: py --version or python --version) | All doc-generation skills. |
Python deps: python-docx, reportlab, requests | python3 -c "import docx, reportlab, requests" | Resume .docx / .pdf generation, Job Description fetching. |
For each missing item, print a one-line fix:
pandoc → brew install pandoc / winget install pandoc / apt install pandoc.pip install python-docx reportlab requests.git config --global user.name "Your Name" etc.If everything is present, say so in one line ("Prereqs: all good") and move on. Do not block onboarding on missing tools. They're only needed when the relevant skill is later invoked.
If $PERSONAL/ or its subfolders don't exist, create them and copy the templates that aren't already in place:
$PERSONAL/career/
$PERSONAL/applications/
$PERSONAL/career/personal-info.md (copy from career/personal-info.template.md if missing)
$PERSONAL/career/goals.md (copy from career/goals.template.md if missing)
$PERSONAL/career/impact-doc.md (copy from career/impact-doc.template.md if missing)
$PERSONAL/career/brag-doc.md (copy from career/brag-doc.template.md if missing)Never overwrite an existing file at this phase. Templates only land in slots that are empty.
The coding-prep skill's company-lookup flow reads from a read-only sibling clone of an upstream open-source repo. Resolve $LEETCODE_BANK per CLAUDE.md (sibling of the main repo, named leetcode-companywise-interview-questions/).
git clone --depth 1 https://github.com/snehasishroy/leetcode-companywise-interview-questions.git "$LEETCODE_BANK"Tell the user what you're doing in one line ("Cloning company-tagged question bank to $LEETCODE_BANK") before running. The clone is several MB and takes a few seconds. Confirm success in one line.
git -C "$LEETCODE_BANK" pull --ff-onlySilent if up-to-date. If it errors (uncommitted changes, diverged), tell the user and skip; do not force-update someone else's clone.
/onboard later or clone manually.Never modify files inside $LEETCODE_BANK. It is upstream-owned. The only writes here are git pull --ff-only to refresh.
Before starting the interview, tell the user (once, briefly):
I'll walk you through four documents: personal info, goals, impact doc, brag doc. You can fill any of them in now, defer to later, or paste raw text I'll structure for you. Filling everything now gives the most accurate resumes, fit analyses, and interview prep. Deferred sections will block the skills that depend on them (e.g., resume-builder needs impact-doc).
Then ask: "Want to go through all four, or pick which ones to do now?"
For each doc in order, ask the user up front:
personal-info.md — quick form: name, email, phone, location, LinkedIn, GitHub. ~2 min. Fill now, defer, or paste a block I'll parse?
Three branches:
Doc-specific guidance:
personal-info.md — simple key/value. Strip the placeholder formatting; write actual values. If the user volunteers links (portfolio, blog), add them as new lines.
goals.md — the template has six sections (current state, target roles, target companies, constraints, what I want, what I'm avoiding). Don't ask all 30+ fields. Ask in groups:
Skip any group the user says they don't have an answer for yet; leave that section as a comment they can fill in.
impact-doc.md — the most important doc and the longest. Ask:
If the user has an existing resume, LinkedIn dump, or old impact doc, offer to ingest it first: "Paste what you have, I'll structure it, then we'll fill the gaps." This is usually faster than cold interviewing.
If the user wants to defer impact-doc, warn them explicitly: "`resume-builder`, `cover-letter-builder`, `star-stories`, and `job-analyzer` all depend on this. They'll work but the output will be generic until you fill it in."
brag-doc.md — four sections (quantified wins, recognition, things shipped, talks/writing/mentorship, failures/lessons). Ask:
Skip "things shipped" and "talks/writing" unless the user volunteers; impact-doc already covers most of that.
Print a compact summary:
Setup complete.
Filled:
- personal-info.md
- goals.md (deferred: target companies, dealbreakers)
Deferred:
- impact-doc.md → blocks resume-builder, cover-letter-builder, star-stories, job-analyzer
- brag-doc.md → used by resume-builder and interview-prep for quantified bullets
Missing tools: pandoc (needed for .docx output)
Suggested next step:
Fill impact-doc.md when you have ~30 min. Then run /help to see what each skill needs.Then stop. Don't auto-launch another skill.
/onboard, gently flag it. Don't force a switch.personal-info.md./help or a specific skill next.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.