跳转到正文
skillsafebeta
← 报告库
用途分类 / 其他用途

Onboarding Skill 安全审计

作者说它能做什么（原文）

When the user wants to optimize post-signup onboarding, user activation, first-run experience, or time-to-value. Also use when the user mentions "onboarding flow," "activation rate," "user activation," "first-run experience," "empty states," "onboarding checklist," "aha moment," "new user experience," "users aren't activating," "nobody completes setup," "low activation rate," "users sign up but do

第三方安全检查结论

发现安全风险

已检查文件
5
发现的风险
5
会不会运行危险命令？检查是否下载程序后直接运行、让他人远程控制电脑，或藏起要运行的命令。未发现风险
会不会泄露文件和密钥？检查是否发送含密码或密钥的文件，以及代码里是否直接写了密钥。发现 1 项风险
中风险

行为追踪和个性化召回可能形成未预期的用户画像

原文依据：5 处
发现了什么

Skill 建议按来源和群组追踪激活、根据用户行为个性化邮件，并以不活跃天数或未完成设置识别“停滞”用户后进行自动或人工联系。

为什么需要注意

实施后会把产品行为、来源、活跃状态和联系渠道组合用于画像及召回。如果未清楚告知、限制保留期或提供退出方式，终端用户可能收到未预期的监控和联系，并产生隐私、合规及品牌风险。

这些是设计建议，并不会自行收集或发送数据；但若照此实施，会把来源、群组、产品行为和不活跃状态用于细分、个性化邮件及人工联系。若终端用户未被告知或无法退出，可能形成超出预期的行为画像与营销触达。用户可要求作者说明同意、保留期限、最小化字段、退出机制以及人工联系的适用条件。

SKILL.md:88来自说明文档打开原文件
### Activation Metrics- % of signups who reach activation- Time to activation- Steps to activation- Activation by cohort/source
查看另外 4 个位置
SKILL.md:151来自说明文档打开原文件
**Trigger-based emails:**- Welcome email (immediate)- Incomplete onboarding (24h, 72h)- Activation achieved (celebration + next step)- Feature discovery (days 3, 7, 14)**Email should:**- Reinforce in-app actions, not duplicate them- Drive back to product with specific CTA- Be personalized based on actions taken
SKILL.md:166来自说明文档打开原文件
### DetectionDefine "stalled" criteria (X days inactive, incomplete setup)### Re-engagement Tactics1. **Email sequence** - Reminder of value, address blockers, offer help2. **In-app recovery** - Welcome back, pick up where left off3. **Human touch** - For high-value accounts, personal outreach
SKILL.md:157来自说明文档打开原文件
**Email should:**- Reinforce in-app actions, not duplicate them- Drive back to product with specific CTA- Be personalized based on actions taken
SKILL.md:164来自说明文档打开原文件
## Handling Stalled Users### DetectionDefine "stalled" criteria (X days inactive, incomplete setup)### Re-engagement Tactics1. **Email sequence** - Reminder of value, address blockers, offer help2. **In-app recovery** - Welcome back, pick up where left off3. **Human touch** - For high-value accounts, personal outreach
会不会删除文件或一直在后台运行？检查是否大范围删除文件、改写磁盘，或设置自动启动。未发现风险
会不会绕过安全保护？检查是否跳过网站安全验证、开放过多文件权限，或取消操作前的确认。未发现风险
会不会误导 AI 或隐藏内容？检查工作说明是否要求 AI 忽略你的指令、干扰检查结果，或夹带看不见的文字。发现 1 项风险
中风险

自动采用仓库营销文件内容，可能引入提示注入

原文依据：1 处
发现了什么

Skill 要求代理读取并“使用”多个项目内 Markdown 文件，但没有要求把其中内容仅作为事实资料、忽略其命令，或在执行敏感操作前再次确认。

为什么需要注意

若仓库、模板或依赖提供的营销文件含有恶意指令，代理的建议或后续操作可能偏离用户请求，并可能影响文件、凭据或账户。这里只能确认存在这条信任路径，不能断言注入已经发生。

这是生效中的指令：代理会自动读取并使用仓库内的营销 Markdown。若该文件由不可信贡献者、依赖或自动化流程修改，其中伪装成资料的命令可能影响代理后续建议或操作。用户可要求作者明确把文件当作不可信数据、忽略其中的操作指令，并限制由其触发的文件、网络或账户操作。

SKILL.md:14来自说明文档打开原文件
**Check for product marketing context first:**If `.agents/product-marketing.md` exists (or `.claude/product-marketing.md`, or the legacy `product-marketing-context.md` filename, in older setups), read it before asking questions. Use that context and only ask for information not already covered or specific to this task.
会不会偷偷改推广链接或收款方？检查是否强制替换推广链接或收款对象，同时要求隐瞒更改。发现 3 项风险
中风险

预先显示虚假进度会误导终端用户

原文依据：2 处
发现了什么

Skill 明确建议把清单显示为已完成 20%，即使该步骤是“代表用户”预先完成的，并以提升完成率为理由。用户可能把这一数字理解为自己真实完成的进度。

为什么需要注意

若界面没有清楚区分系统预配置与用户完成事项，会形成带有欺骗性的进度暗示，可能提高短期转化但损害信任，并带来消费者保护或暗黑模式风险。

这段证据能说明什么

材料确实建议清单从“20% done”开始，但也说明这是因为某一步已代表用户预先完成；这可能是真实的默认配置或导入工作，并不必然是假进度。风险取决于界面是否清楚标明完成了什么、由谁完成。用户可要求进度只计算可验证成果，并把系统代办步骤明确标注为自动完成。

这项判断针对展示的代码和适用条件，不表示风险已经实际发生。
SKILL.md:43来自说明文档打开原文件
The principles that make progress mechanics, checklists, and prompts actually work:- **Endowed Progress Effect** — people finish faster when progress is already started for them. A checklist that opens at "20% done" (a step pre-completed on their behalf) drives roughly **+40% completion** vs. starting at 0%. Give users a head start, don't make them start from nothing.- **Peak-End Rule** — users remember an experience by its most intense moment (the *peak*) and its *end*, not the average. Engineer a clear high point (a win, a wow, a celebration) and end each session on a positive note.
查看另外 1 个位置
references/experiments.md:40来自说明文档打开原文件
### Progress & Motivation| Test | Hypothesis ||------|------------|| Progress bars | Show completion percentage || Checklist length | 3-5 items vs. 5-7 items || Gamification | Badges, rewards, achievements || Completion messaging | "X% complete" visibility || Starting point | Begin at 20% vs. 0% || Celebration moments | Acknowledge completions |
中风险

“先吸引再限制”的付费策略可能促成强制性产品设计

原文依据：2 处
发现了什么

参考材料不只是比较收费模式，而是规定免费体验应当让用户上钩但不能满足，并要求设置限制使持续价值必须升级付费。

为什么需要注意

如果机械实施，产品可能故意削弱免费体验或在用户投入数据和时间后设置付费障碍，导致锁定感、退款争议、信任损失或与面向消费者的公平设计要求冲突。

参考文件给出的不是中性比较，而是明确要求免费体验“hook, not satisfy”，并让持续价值依赖付费升级。若用于隐藏关键限制、先培养依赖再突然设限，可能影响用户的知情购买决定；正常、预先披露的功能或容量分级则风险较低。用户可要求限制和价格在注册前清楚披露，并避免把用户数据或核心工作成果锁在付费墙后。

references/activation-models.md:43来自说明文档打开原文件
## The Evernote vs. Notion parableTwo lessons on how much to give away:- **Evernote — gave away too much free.** The free tier was generous enough that most users never needed to upgrade. Free was a destination, not a doorway. Growth without matching monetization.- **Notion — hook, then limit.** Let users experience real value, then hit meaningful limits (blocks, members, features) that create a natural, well-timed reason to pay.The principle: **the free experience should hook, not satisfy.** Give enough value to prove the product and build the habit — but structure the limits so that continued value requires upgrading.
查看另外 1 个位置
references/activation-models.md:52来自说明文档打开原文件
## Choosing1. Start from your market (Model-Market Fit), not your preference.2. Decide the card-vs-no-card tradeoff explicitly: volume of leads vs. quality of leads.3. Design the free/trial experience to hook and then limit — never to fully satisfy.4. Whatever the model, the onboarding inside it still needs the shortest possible path to value (see [minimum-path-to-value.md](minimum-path-to-value.md)).
中风险

未注明来源的精确基准可能误导定价和 onboarding 决策

原文依据：3 处
发现了什么

材料给出多项精确效果量和行业基准，例如信用卡要求使注册下降 50–70%、转化提高 2–3 倍，以及首日流失比例，但所提供文件没有给出研究来源、样本或适用范围。

为什么需要注意

团队可能据此选择信用卡门槛、试用长度或激进缩短流程；如果其市场与原样本不同，可能损失大量合格用户、收入或实验时间。

材料把信用卡、试用流失和预填进度的效果写成精确数字，但所提供文本没有研究出处、样本、行业、时间范围或不确定性。这些数字可能不适用于特定产品，却会直接影响收费门槛和 onboarding 设计。用户可要求作者提供可核查来源和适用范围，并把这些数字仅当作待验证假设，通过自身数据和受控实验确认。

references/activation-models.md:13来自说明文档打开原文件
### 2. Free trialFull (or near-full) access for a fixed window: **3, 7, 14, or 30 days**.- Shorter trials create urgency and force faster time-to-value; longer trials suit complex products with longer setup.- **Credit-card requirement is the key lever**: requiring a card up front **cuts signups by 50–70%**, but the users who do sign up **convert 2–3× better**. Fewer, higher-intent leads vs. more, lower-intent leads — choose based on your funnel goals.
查看另外 2 个位置
references/minimum-path-to-value.md:13来自说明文档打开原文件
## The abandonment realityYou have far less time and patience than you think:- **40–60% of users who sign up for a free trial abandon after a single session** — and never return.- **75–80% of trial abandonment happens within the first day.**The decision to stick or bail is made almost immediately. If value isn't reached in the first session, most users are already gone. MPTV exists because the window is that small.
SKILL.md:43来自说明文档打开原文件
The principles that make progress mechanics, checklists, and prompts actually work:- **Endowed Progress Effect** — people finish faster when progress is already started for them. A checklist that opens at "20% done" (a step pre-completed on their behalf) drives roughly **+40% completion** vs. starting at 0%. Give users a head start, don't make them start from nothing.- **Peak-End Rule** — users remember an experience by its most intense moment (the *peak*) and its *end*, not the average. Engineer a clear high point (a win, a wow, a celebration) and end each session on a positive note.

Skill 逻辑拆解

8 个说明模块

该 Skill 主要生成 onboarding 审计、流程、文案、邮件触发条件和指标方案；所示内容没有直接执行脚本或安装命令。

查看原文
SKILL.md:200来自说明文档打开原文件
## Output Format### Onboarding AuditFor each issue: Finding → Impact → Recommendation → Priority### Onboarding Flow Design- Activation goal- Step-by-step flow- Checklist items (if applicable)- Empty state copy- Email sequence triggers- Metrics plan

它要求先读取项目中的产品营销上下文，再询问缺失信息并给出建议。

查看原文
SKILL.md:14来自说明文档打开原文件
**Check for product marketing context first:**If `.agents/product-marketing.md` exists (or `.claude/product-marketing.md`, or the legacy `product-marketing-context.md` filename, in older setups), read it before asking questions. Use that context and only ask for information not already covered or specific to this task.

其方法围绕缩短首次价值路径、分析激活与留存，并通过实验迭代 onboarding。

查看原文
SKILL.md:27来自说明文档打开原文件
### 1. Time-to-Value Is EverythingRemove every step between signup and experiencing core value. Design the **Minimum Path to Value (MPTV)** — the least number of steps to experience enough value to make a confident decision (see [references/minimum-path-to-value.md](references/minimum-path-to-value.md)).### 2. One Goal Per SessionFocus first session on one successful outcome. Save advanced features for later.
SKILL.md:88来自说明文档打开原文件
### Activation Metrics- % of signups who reach activation- Time to activation- Steps to activation- Activation by cohort/source
从这里开始 · 工作说明SKILL.md
onboarding
连线表示工作说明包含的模块，不是实际运行顺序。点击模块可查看原文。 另有 7 个章节，可在原文件中查看。

文件引用关系图

4 处引用
哪些文件发起引用引用了什么
连线表示真实的文件引用，不是运行顺序。点击节点可高亮相关连线，并查看具体文件和原文位置。虚线表示还有文件需要定位。
文件与检查记录5 个文件

检查范围与遗漏

逐文件查看涉及的内容

下方列出本次涉及的原文范围；纳入检查不代表已查清所有问题。

  • SKILL.md已纳入全文
  • references/activation-models.md已纳入全文
  • references/experiments.md已纳入全文
  • references/minimum-path-to-value.md已纳入全文
  • evals/evals.json已纳入全文

这份报告只针对上方版本。我们看了拿到的代码和说明文件，没有实际运行 Skill，也没有检查它另外安装的软件包。因此，这不是“保证安全”的承诺；换了版本或使用环境，结果也可能不同。

  • SKILL.md工作说明
  • evals/evals.json配套文件
  • references/activation-models.md配套文件
  • references/experiments.md配套文件
  • references/minimum-path-to-value.md配套文件
读取了多少行
738
文件校验值（用于核对版本）
0ef9581586763aea77392f9e94a70022be2e44f6ebd0a255446feb93275a8f7d