Nex Onboarding

• Outcome: Pass
• Latest audit: May 29, 2026 · 8:35 PM UTC
• Version: 1.0.0

Overview

This is a disclosed local client-onboarding tracker that stores and can export client records on the user's machine, with no evidence of hidden network access, credential harvesting, or destructive behavior.

Install only if you are comfortable running a setup script that creates files in ~/.nex-onboarding and a command wrapper in ~/.local/bin. Treat the database and exports as sensitive client records, avoid putting passwords or service credentials into notes, review CSV exports before opening them in spreadsheets, and delete ~/.nex-onboarding manually if you need to remove retained data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares no permissions while explicitly instructing the agent to run a shell setup script and use a local SQLite-backed CLI that writes under ~/.nex-onboarding/. This creates a transparency and consent gap: users and policy engines may not realize the skill can execute shell commands and persist files, increasing the chance of unintended code execution or local data modification.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: Trigger phrases such as "new client," "checklist," and especially "next step" are broad enough to match routine conversation outside the intended onboarding context. Overly broad invocation can cause the skill to activate unexpectedly and operate on stored client records or prompt file-writing workflows when the user did not intend to use this tool.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill handles and exports client names, email addresses, phone numbers, onboarding notes, and workflow status, but the description does not warn users that this information is stored locally and can be exported. Without clear disclosure, users may unknowingly process sensitive business and personal data, leading to privacy, compliance, or accidental sharing risks.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The export function serializes and returns stored client data, including personal information and free-form notes, in JSON or CSV without any built-in authorization, redaction, or safe CSV escaping. In this skill context, onboarding records can contain sensitive business and personal data, so unrestricted export increases the risk of privacy leakage and CSV/formula injection if exported files are opened in spreadsheet software.

Session Persistence

Medium

• Category: Rogue Agent

Content

---
name: nex-onboarding
description: Comprehensive client onboarding workflow management system for web agencies, design studios, and service providers. Manage complete client setup processes from contract signing through go-live with structured checklists (opstarten), task progress tracking, and bottleneck detection. Create onboarding workflows covering administrative tasks (contract, payment processing, afronding), technical setup (domain configuration, DNS transfers, SSL certificates, email setup), design and branding (logo requests, brand guidelines), content gathering, and communication milestones (welcome emails, kickoff calls, training, feedback collection). Track progress with completion percentages, visual checklists, and status indicators. Mark steps complete, skip steps when clients handle them independently, or block steps when waiting on client input. Identify most commonly blocked steps to improve workflow efficiency. Assign onboarding steps to team members, export progress data for reporting, and view onboarding statistics across multiple active clients. Support different engagement tiers (starter, standard, premium, enterprise) with customizable templates. Perfect for Belgian agency operators who need systematic client onboarding to reduce errors, improve client satisfaction, and scale client acquisition.
version: 1.0.0
metadata:
  clawdbot:

• Confidence: 88% confidence
• Finding: Create onboarding workflows covering administrative tasks (contract, payment processing, afronding), technical setup (domain configuration, DNS transfers, SSL certificates, email setup), design and br

VirusTotal

67/67 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.