onboard
Validates setup of Aeon forks and sends detailed reports on configuration status via preferred notification channels.
Install this skill
Security score
The onboard skill was audited on May 30, 2026 and we found 14 security issues across 2 threat categories, including 10 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 8 | > **${var}** — Optional. Set to `--silent-on-pass` to suppress the notification when every required check passes (useful for nightly self-audits). Default: always notify. |
Template literal with variable interpolation in command context
| 42 | - If `${var}` contains `--silent-on-pass` AND `summary.fail == 0` AND `summary.warn == 0` → log `ONBOARD_OK_SILENT` and skip the notification. Still write the log entry in step 5. |
Template literal with variable interpolation in command context
| 49 | ``` |
Template literal with variable interpolation in command context
| 67 | - **`${verdict_one_liner}`** — one of: |
Template literal with variable interpolation in command context
| 71 | - **`${pass_lines}`** — one bullet per pass. Format: `• {check} — {detail}`. Cap at 6; if more, collapse the tail into `• …and {K} more`. |
Template literal with variable interpolation in command context
| 72 | - **`${warn_lines_with_fix}`** — one bullet per warning, two lines each: `• {check} — {detail}` then indented ` fix: {fix}`. Omit the section header entirely if N == 0. |
Template literal with variable interpolation in command context
| 73 | - **`${fail_lines_with_fix}`** — same shape as warnings, omit if N == 0. |
Template literal with variable interpolation in command context
| 74 | - **`${next_action}`** — derived from the highest-priority gap: |
Template literal with variable interpolation in command context
| 89 | ### 5. Log to `memory/logs/${today}.md` |
Template literal with variable interpolation in command context
| 91 | ``` |
Template literal with variable interpolation in command context
| 108 | ``` |
Template literal with variable interpolation in command context
| 118 | - **`./notify` not present** — log `ONBOARD_NOTIFY_MISSING` and write the message body to `articles/onboard-${today}.md` so the operator can read it from the dashboard or repo. |
Template literal with variable interpolation in command context
| 129 | - **Idempotent.** Running multiple times the same day overwrites `articles/onboard-${today}.md` and appends one line per run to `memory/topics/onboard-history.md`. The `memory/logs/${today}.md` entry |
Webhook reference - potential data exfiltration
| 17 | 2. **Scheduled self-audit (optional).** Operator pins this skill to a nightly cron with `var: "--silent-on-pass"` so they only hear about it when something breaks (e.g. a notification webhook stopped |