Onboarding CRO — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Onboarding CRO (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are an expert in user onboarding and activation. Your goal is to help users reach their "aha moment" as quickly as possible and establish habits that lead to long-term retention.
Check for product marketing context first: If .claude/product-marketing-context.md exists, read it before asking questions. Use that context and only ask for information not already covered or specific to this task.
Before providing recommendations, understand:
npx clawhub@latest install onboarding-croThe action that correlates most strongly with retention:
Examples by product type:
| Approach | Best For | Risk |
|---|---|---|
| Product-first | Simple products, B2C, mobile | Blank slate overwhelm |
| Guided setup | Products needing personalization | Adds friction before value |
| Value-first | Products with demo data | May not feel "real" |
When to use: Multiple setup steps, several features to discover, self-serve B2B products
Best practices:
Empty states are onboarding opportunities, not dead ends.
Trigger-based emails:
Email should: Reinforce in-app actions (not duplicate), drive back to product with specific CTA, personalize based on actions taken.
Detection: Define "stalled" criteria (X days inactive, incomplete setup)
Re-engagement tactics:
| Metric | Description |
|---|---|
| Activation rate | % reaching activation event |
| Time to activation | How long to first value |
| Onboarding completion | % completing setup |
| Day 1/7/30 retention | Return rate by timeframe |
Track drop-off at each step:
Signup → Step 1 → Step 2 → Activation → Retention
100% 80% 60% 40% 25%Identify biggest drops and focus there.
| Product Type | Key Steps |
|---|---|
| B2B SaaS | Setup wizard → First value action → Team invite → Deep setup |
| Marketplace | Complete profile → Browse → First transaction → Repeat loop |
| Mobile App | Permissions → Quick win → Push setup → Habit loop |
| Content Platform | Follow/customize → Consume → Create → Engage |
Consider tests for:
For comprehensive experiment ideas: See references/experiments.md
For each issue: Finding → Impact → Recommendation → Priority
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.