Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/ericrisco/rsc-harness/codebase-onboardingnpx skills add ericrisco/rsc-harness --skill codebase-onboardinggit clone --depth 1 https://github.com/ericrisco/rsc-harnessWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00083 | $0.02359 |
| Opus 5 | $0.00042 | $0.01179 |
| Sonnet 5 | $0.00017 | $0.00472 |
| Haiku 4.5 | $0.00008 | $0.00236 |
Grade A, and why
codebase-onboarding scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 129 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Codebase onboarding — get oriented fast, leave a map
You have just landed in a codebase you did not write: a fresh clone, an inherited project, an acquired repo, an abandoned side project someone handed you. The instinct is to start reading files top-to-bottom. Resist it. That is how a week disappears and you still cannot answer "where does X happen". This skill runs a disciplined breadth-first reconnaissance pass and produces one durable artifact: a map a teammate can trust and you can re-read tomorrow.
The payoff is measured. Engineers using AI to onboard reach the same milestones roughly 2x faster — productive in 1–2 weeks instead of 4–6 — and the biggest gains are exactly in searching for code, decoding undocumented patterns, and tracing data flows (super-productivity.com, accessed 2026-06-02). That is what the recon pass below targets, in order.
Lead with the deliverable
Before you grep a single line, know the target: a single living file, CODEBASE-MAP.md, committed at the repo root. You work backward from its sections — every recon step fills one. Minimal schema:
# CODEBASE-MAP.md — <repo name>
## Stack # languages, framework + versions, package manager, run scripts
## Entry points # main / server bootstrap / route registration / CLI commands
## Request flow # one real path traced transport -> business logic -> persistence
## Module ownership # who owns transport / business logic / persistence / UI
## Hidden behavior # cron, webhooks, queue workers, event listeners, env branches
## Hotspots # most-churned + most-complex files = highest risk
## How to run # the exact commands to boot it and hit one path locally
Why a file and not a chat answer: a map that lives only in the conversation dies when the session ends, and the next agent re-does the work. The artifact is the point. verify.sh checks these sections exist (structure, not content).
Two operating rules
- Breadth before depth. First pass maps where things are, not how they work. You are drawing the subway map, not reading every passenger's diary. Depth is
analyze/debugwork, on demand, later. — Reading everything is the failure mode onboarding exists to replace. - Hypothesis before answer. Spend ~5 minutes forming your own guess ("auth probably lives in
src/middleware"), then grep to confirm or kill it. — Verifying a hypothesis builds the mental model that makes you fast; a handed-to-you answer does not stick (martinfowler.com, Böckeler, accessed 2026-06-02).
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 129 lines · 83 tokens per session scan A ddf55cfff35b
codebase-onboarding is a skill published in the GitHub repository ericrisco/rsc-harness (58 stars, last pushed 3d ago), licensed MIT. It adds 83 tokens to every session and 2,359 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
repository-discovery
Use this skill to systematically explore an unfamiliar codebase before making any changes. Activates when starting work in an unknown repository, adding a new feature, debugging without prior context, or when no CONTEXT.md exists. Produces a grounded understanding of architecture, conventions, and constraints.
codebase-onboarding
Maps an unfamiliar repo before touching its code.
explain-codebase
Drop into any repo and generate a structured architecture overview. Maps the codebase, identifies entry points, frameworks, and dependencies — then produces a "start here" guide for new contributors.
codebase-gap-analysis
Analyze a user's codebase against a reference architecture to identify gaps and provide prioritized enhancement recommendations.
context-builder
Gather comprehensive project context before starting implementation. Use at the beginning of complex tasks to understand codebase structure, dependencies, patterns, and conventions before writing code.
repo-onboarding
Systematically map an unfamiliar codebase before changing it — entry points, build/test loop, conventions, data flow. Use when starting work in a repo you haven't seen, or asked "how does this codebase work?".