user-onboarding
Audited by ZeroLeaks on Apr 15, 2026
The SKILL.md is clear, fully declarative, and easy to review—it describes a conversational advisory skill about product onboarding design with no tool invocations, file operations, or external fetches. It stays clear of instruction/data boundary issues and does not push the agent to treat user-supplied content as trusted policy. The tested scenarios did not show material prompt-injection risk or skill-induced worsening of downstream behavior. Confidence is low not due to the skill's content—which looks clean—but because behavior analysis was not run, leaving a gap in validating whether the skill materially changes downstream agent behavior compared to baseline.
This is a purely advisory/conversational skill about product onboarding design. It contains no tool invocations, no shell commands, no remote fetches, no file writes, no external communication, and no hidden execution paths. All behavior is fully described in the markdown.
The scanned skill keeps data and instructions reasonably separate and does not strongly encourage the agent to treat external content as policy.
Behavior analysis was not run.