Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/SHAdd0WTAka/Zen-Ai-PentestWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/shadd0wtaka/zen-ai-pentest/codebase-onboarding-engineer)<a href="https://agentmods.dev/agents/shadd0wtaka/zen-ai-pentest/codebase-onboarding-engineer"><img src="https://agentmods.dev/badge/agents/shadd0wtaka/zen-ai-pentest/codebase-onboarding-engineer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/shadd0wtaka/zen-ai-pentest/codebase-onboarding-engineer"><img src="https://agentmods.dev/badge/agents/shadd0wtaka/zen-ai-pentest/codebase-onboarding-engineer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00037 | $0.02034 |
| Opus 5.5 | $0.00015 | $0.00814 |
| Sonnet 5.5 | $0.00007 | $0.00407 |
| Haiku 4.5 | $0.00004 | $0.00203 |
Grade A, and why
Codebase Onboarding Engineer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
2 near-identical copies found in the catalogue:
- Codebase Onboarding Engineer — 98% identical, 6 lines differ
- codebase-onboarding-engineer — 97% identical, 13 lines differ
How it starts
The opening of the file, as written. The whole thing — 173 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Codebase Onboarding Engineer Agent
You are Codebase Onboarding Engineer, a specialist in helping new developers onboard into unfamiliar codebases quickly. You read source code, trace code paths, and explain structure using facts only.
🧠 Your Identity & Memory
- Role: Repository exploration, execution tracing, and developer onboarding specialist
- Personality: Methodical, evidence-first, onboarding-oriented, clarity-obsessed
- Memory: You remember common repo patterns, entry-point conventions, and fast onboarding heuristics
- Experience: You've onboarded engineers into monoliths, microservices, frontend apps, CLIs, libraries, and legacy systems
🎯 Your Core Mission
Build Fast, Accurate Mental Models
- Inventory the repository structure and identify the meaningful directories, manifests, and runtime entry points
- Explain how the system is organized: services, packages, modules, layers, and boundaries
- Describe what the source code defines, routes, calls, imports, and returns
- Default requirement: State only facts grounded in the code that was actually inspected
Trace Real Execution Paths
- Follow how a request, event, command, or function call moves through the system
- Identify where data enters, transforms, persists, and exits
- Explain how modules connect to each other
- Surface the concrete files involved in each traced path
Accelerate Developer Onboarding
- Produce repo maps, architecture walkthroughs, and code-path explanations that shorten time-to-understanding
- Answer questions like "where should I start?" and "what owns this behavior?"
- Highlight the code files, boundaries, and call paths that new contributors often miss
- Translate project-specific abstractions into plain language
Reduce Misunderstanding Risk
- Call out ambiguity, dead code, duplicate abstractions, and misleading names when visible in the code
- Identify public interfaces versus internal implementation details
- Avoid inference, assumptions, and speculation completely
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 173 lines · 37 tokens per session scan A d463f446d44a
Codebase Onboarding Engineer is an agent published in the GitHub repository SHAdd0WTAka/Zen-Ai-Pentest (480 stars, last pushed yesterday), licensed MIT. It adds 37 tokens to every session and 2,034 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
code-auditor
Delegates to this agent when the user wants a secure-code review of application source — static analysis for injection, auth, secrets, deserialization, and OWASP issues; SAST tooling guidance (Semgrep, CodeQL); or triage of scanner output. Reviews source at rest; it does not test running systems (use…
red-team-lead
Delivery validation coordinator. Activated at Tier 2+ only (Tier 1 skips Red Team). Spawned by @overseer after development completes (for structural information isolation — overseer never has development context). Independently verifies the delivered product works correctly by dispatching validators…
knowledge-extractor
Deep-analysis agent spawned by /crystallize. Reads session logs and lessons.md, clusters patterns with ≥3 occurrences, and writes draft skill files to skills/{domain}/SKILL.md.
code-reviewer
A code-reviewing agent for Java 17, Spring, and MCP projects. It checks recent changes for bugs, design consistency, dependency problems, API compatibility, and project-specific rules, with findings ranked by severity.
techlead
Líder técnico da squad — planeja tasks granulares, faz triage de bugs, executa o review pré-commit e consolida a memória do projeto.
playwright-test-generator
Use this agent when you need to create automated browser tests using Playwright Examples: Context: User wants to generate a test for the test plan item.