# First Contact

> Red-team onboarding and first use to find confusion, broken expectations, and abandonment.

- **Type:** Skill
- **Install:** `agentstack add skill-carlkibler-agent-skills-first-contact`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [carlkibler](https://agentstack.voostack.com/s/carlkibler)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [carlkibler](https://github.com/carlkibler)
- **Source:** https://github.com/carlkibler/agent-skills/tree/main/skills/first-contact

## Install

```sh
agentstack add skill-carlkibler-agent-skills-first-contact
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# First-Run Red Team

Use this skill to attack the first 5-15 minutes of the product experience.

A first-run red team is about finding where a new user:
- gets confused
- hesitates
- grants a permission without understanding it
- denies a permission and never recovers
- thinks the app is broken
- never reaches the promised “aha” moment

## When to Use

Use this skill when reviewing:
- install flow
- onboarding
- permission requests
- setup checklists
- first successful action
- first failure recovery
- menu bar or background apps where state is easy to miss

## Core Principle

The first-run experience fails when the product asks the user to do too much, trust too much, or infer too much before value is obvious.

## Step 1: Map the first-run path

Build a minute-by-minute path from:
- discovery / install
- launch
- first window or menu
- setup tasks
- permission prompts
- first success moment
- first screenshot / first sync / first alert / first rename / first whatever the product does
- first failure state and recovery

If there are multiple likely paths, audit the default path first.

## Step 2: Simulate multiple user mindsets

At minimum, simulate these personas:
- **In a hurry** — wants value in under 2 minutes
- **Skeptical** — suspicious of permissions, billing, AI, or privacy
- **Normal but inattentive** — will miss subtle text and icon changes
- **Slightly unlucky** — hits one bad edge case early

For each persona, walk the path step by step.

## Step 3: Find first-run failure points

Look for:
- unexplained permissions
- unclear prerequisites
- too many decisions too early
- jargon, hidden defaults, or settings that matter more than they look
- moments where the app appears idle or dead
- weak proof that setup succeeded
- confusing recovery after a denial, skip, or transient failure
- ways an early failure poisons the user’s mental model permanently

## Step 4: Score the friction

For each failure point, include:
- **Moment**
- **What the user is trying to do**
- **What blocks or confuses them**
- **Likely user interpretation**
- **Abandonment risk** — low/medium/high
- **Recovery quality** — good/weak/bad
- **Fastest fix** — product / copy / diagnostics / state visibility / defaults

## Step 5: Present the walkthrough

Use this format:

```markdown
# First-Run Red Team: [Product / Feature]

## Executive Read
- First-run step most likely to lose the user:
- Permission moment most likely to fail:
- Moment where the app most likely looks dead:
- Fastest improvement to lift activation:

## First-Run Timeline
1. [step]
2. [step]
3. [step]

## Failure Points

### 1. [Title]
**Moment:**
**User goal:**
**What goes wrong:**
**Likely interpretation:**
**Abandonment risk:**
**Recovery quality:**
**Fastest fix:**

## Persona Notes
### In a hurry
- ...
### Skeptical
- ...
### Normal but inattentive
- ...
### Slightly unlucky
- ...

## Activation Killers
- [issue]
- [issue]
- [issue]

## Highest-Leverage First-Run Fixes
1. [ ]
2. [ ]
3. [ ]
```

## Success Criteria

The red team is complete when it identifies:
- where the user is most likely to bail
- where the app most likely looks broken or suspicious
- where a denied permission or skipped step becomes unrecoverable
- the smallest changes that would materially improve activation

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [carlkibler](https://github.com/carlkibler)
- **Source:** [carlkibler/agent-skills](https://github.com/carlkibler/agent-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-carlkibler-agent-skills-first-contact
- Seller: https://agentstack.voostack.com/s/carlkibler
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.