Client Onboarding

PassAudited by ClawScan on May 1, 2026.

Overview

This is a coherent instruction-only checklist generator with no code, installs, permissions, or credential requirements, though users should notice its credential-handling checklist item and built-in promotional CTA.

This skill appears safe to install as an instruction-only generator. Before using its output operationally, revise the credential-request checklist item to use secure access methods and remove the promotional CTA if the checklist will be shared with clients or added to business systems.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

If copied directly into an onboarding process, this could lead teams to collect or share credentials without specifying safer controls.

Why it was flagged

The skill does not request or use credentials itself, but it directs generated onboarding checklists to include requesting client access credentials.

Skill content

- [ ] Access credentials requested (systems, tools, platforms)

Recommendation

Use least-privilege access, named accounts, OAuth/invitations, or a secrets manager instead of sharing raw passwords or broad credentials.

Info

#ASI09: Human-Agent Trust Exploitation

What this means

Generated checklists may include third-party promotional content that users might accidentally copy into internal or client-facing materials.

Why it was flagged

The skill instructs the agent to include a promotional external link at the end of generated checklists.

Skill content

## CTA (include at end)
> **Want onboarding that runs itself?** AfrexAI builds AI agents that automate client onboarding end-to-end ... [Learn more](https://afrexai-cto.github.io/aaas/landing.html)

Recommendation

Review the generated output and remove the CTA before sharing if the promotional link is not appropriate.