← Back to Skills Marketplace
rithythul

Nimmit Onboarding

by rithythul · GitHub ↗ · v1.0.0 · MIT-0
cross-platform ⚠ suspicious
79
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install nimmit-onboarding
Description
Use when a new user messages the bot for the first time or sends /start. Guides them through conversational onboarding — organization setup, industry, langua...
Usage Guidance
This skill appears to do what it says (conversational onboarding) but its runtime steps will modify your workspace and system (write files, copy/install 'skill packs', and create a cron job) without specifying where those skill packs come from or asking for explicit consent. Before installing or enabling this skill: 1) Ask the publisher to list exactly which skill packs will be installed and their sources (URLs, registry names, or repository release tags). 2) Require that installs perform cryptographic verification or come from a trusted registry. 3) Restrict or review any exec/copy operations and cron changes in a sandbox environment first. 4) Ensure you have an allowlist for which users can trigger onboarding and a way to review/rollback changes to IDENTITY.md, SOUL.md, HEARTBEAT.md, TASKS.md and crontab. 5) If you cannot verify the provenance of skill packs or want tighter control, do not enable automated installation/scheduling and require manual approval for setup steps. If you want more certainty, ask the skill author for an explicit install plan or provide the list of skill packs here for review.
Capability Analysis
Type: OpenClaw Skill Name: nimmit-onboarding Version: 1.0.0 The nimmit-onboarding skill bundle automates the configuration of the OpenClaw agent by modifying core system files (IDENTITY.md, SOUL.md) and utilizing high-risk capabilities such as 'exec' for installing skill packs and 'cron' for establishing persistence (daily briefings). While these actions are aligned with the stated purpose of user onboarding, the instructions to execute technical steps silently and the use of powerful system-level tools without explicit user confirmation for each command pose a significant security risk.
Capability Assessment
Purpose & Capability
The stated purpose (conversational onboarding via Telegram) aligns with creating org/profile files (IDENTITY.md, TASKS.md) and scheduling briefings. However, instructions to 'install the matching skill pack(s)' and to use exec/copy to manipulate skill packs are more powerful than a simple chat flow and should be justified by the author (where do skill packs come from, which ones, from what source?).
Instruction Scope
SKILL.md explicitly instructs the agent to use write to update workspace files, use exec to copy/install skill packs, and use cron to schedule daily briefings. These actions read and modify persistent workspace state and system scheduling. The instructions do not constrain the source of skill packs, do not require explicit user consent for installation, and say to perform setup 'silently' (no technical details to user), which increases risk of unreviewed changes.
Install Mechanism
There is no install spec in the registry, but the runtime instructions tell the agent to install/copy skill packs via exec. Because provenance and installation steps are unspecified, this could lead to installing arbitrary code or untrusted packages. The manifest gives no safe source or verification for any install.
Credentials
The skill requests no environment variables, credentials, or external config paths in the manifest. It operates on workspace files (IDENTITY.md, SOUL.md, etc.), which is proportionate to onboarding. No unrelated secrets are requested.
Persistence & Privilege
Although always:false and user-invocable:true (good), the skill instructs creating a cron job to send daily briefings and to install skill packs, which grants it persistent behavior and ongoing side effects. The skill would modify system scheduling and workspace contents without details on approvals or rollback.
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install nimmit-onboarding
  3. After installation, invoke the skill by name or use /nimmit-onboarding
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
nimmit-onboarding 1.0.0 - Initial release of conversational onboarding for new Nimmit users via Telegram chat. - Guides first-time users through organization setup, industry selection, language preference, team size, and top priorities—no technical steps required. - Fully chat-based: never asks users to run commands or open a terminal. - Handles edge cases such as users with existing setups and Khmer language support. - Automates workspace file updates, skill pack installation, and daily morning briefing scheduling behind the scenes.
Metadata
Slug nimmit-onboarding
Version 1.0.0
License MIT-0
All-time Installs 0
Active Installs 0
Total Versions 1
Frequently Asked Questions

What is Nimmit Onboarding?

Use when a new user messages the bot for the first time or sends /start. Guides them through conversational onboarding — organization setup, industry, langua... It is an AI Agent Skill for Claude Code / OpenClaw, with 79 downloads so far.

How do I install Nimmit Onboarding?

Run "/install nimmit-onboarding" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is Nimmit Onboarding free?

Yes, Nimmit Onboarding is completely free, licensed under MIT-0. You can download, install and use it at no cost.

Which platforms does Nimmit Onboarding support?

Nimmit Onboarding is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created Nimmit Onboarding?

It is built and maintained by rithythul (@rithythul); the current version is v1.0.0.

💬 Comments