referral-loop — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited referral-loop (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The best channel is users inviting users — especially for connection products where value grows with network size. Referral fails when the invite is spammy or the incentive feels like a pyramid scheme.
Chains from [[growth-strategy]] (ICP, north-star metric) and [[community-engagement]] (engaged users refer more). Complements [[email-nurture]] (referral prompts in sequences) and [[social-distribution]] (share assets).
Use referral-loop checklist alongside this process.
Skip when: product isn't shareable, no clear invite moment, or core experience broken (fix product first).
Best triggers — user just got value:
| Moment | Example copy |
|---|---|
| First successful connection | "Know someone who'd benefit?" |
| Profile complete | "Invite a colleague to join you" |
| Weekly win | "Share what you built" |
| Waitlist | "Move up by inviting friends" |
Never ask on sign-up screen before first value.
User gets value → Prompt to share → Easy share mechanism → Friend lands → Friend activates
↑___________________________________|
(reward optional)Components:
?ref=username)| Type | Example | Risk |
|---|---|---|
| Access | Skip waitlist, unlock feature | Low — preferred |
| Status | Badge, early access | Low |
| Mutual benefit | Both get premium week | Medium — monitor abuse |
| Cash/gift cards | $10 per referral | High — fraud, wrong incentives |
Prefer access and status over cash for dev audiences.
| Metric | Formula |
|---|---|
| Invite rate | % MAU who sent ≥1 invite |
| Viral coefficient (K) | invites × conversion rate |
| Referral % of sign-ups | referred / total new |
| Referred user activation | vs organic cohort |
K > 0.15 is meaningful for early products; K > 1.0 is exceptional.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.