rapid-onboard
Given a documentation URL, crawl the docs and produce a fast-onboarding brief — mental model, the core 20% of the API, beginner gotchas, a runnable spike, and a cheat sheet. Use when the user pastes a docs link and wants to "get up to speed", "learn this fast", "onboard", "give me the 20%", or otherwise asks for a quick practical overview of a library, framework, API, or tool from its documentation.
85
100%
Does it follow best practices?
Impact
90%
1.18xAverage score across 1 eval scenario
Low
Low-risk findings worth noting
Low
Low-risk findings.
2 low severity findings. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
Outsider free text is ingested because the skill takes a user-supplied documentation URL, fetches arbitrary public docs pages at runtime (via `WebFetch`), extracts their in-domain link text/content, and then feeds that fetched page prose into the agent’s LLM context for summarization and symbol extraction.
W012: Unverifiable external dependency detected (runtime URL that controls agent).
What this means
The skill fetches instructions or code from an external URL at runtime, and the fetched content directly controls the agent’s prompts or executes code. This dynamic dependency allows the external source to modify the agent’s behavior without any changes to the skill itself.
Why it was flagged
The skill explicitly fetches the user-provided documentation URL and related docs-root files at runtime (e.g. https://<docs-host>/sitemap.xml and https://<docs-host>/llms.txt or the supplied docs page URL) and injects those fetched pages into the agent context to drive prompts and generate the runnable spike, so those external resources directly control the agent's outputs.
- Repository
- moodec/useful-claude-skills
- Commit
84f0498
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.