Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add gustavo-meilus/aiboarding --skill update-agent-onboardinggit clone --depth 1 https://github.com/gustavo-meilus/aiboardingWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/gustavo-meilus/aiboarding/update-agent-onboarding)<a href="https://agentmods.dev/skills/gustavo-meilus/aiboarding/update-agent-onboarding"><img src="https://agentmods.dev/badge/skills/gustavo-meilus/aiboarding/update-agent-onboarding.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00062 | $0.01532 |
| Opus 5 | $0.00031 | $0.00766 |
| Sonnet 5 | $0.00012 | $0.00306 |
| Haiku 4.5 | $0.00006 | $0.00153 |
Grade A, and why
update-agent-onboarding scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 109 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Updating agent onboarding files
Keep AGENTS.md current as the project evolves, without re-grilling the whole repo.
Announce at start: "Using update-agent-onboarding to triage onboarding drift."
Runtime awareness
Works under Claude Code, Codex, Copilot CLI, or any SKILL.md-compatible agent - the triage and patch logic below has no runtime dependency. Claude repo hooks and optional native Codex plugin hooks can nudge; when unavailable, disabled, untrusted, or using copied standalone skills, run this skill manually after meaningful commits.
Managed refresh
For an existing Claude installation, before classification compare the current
plugin's templates/hooks/drift-check and templates/tools/classify-drift with
their managed copies. If either is missing or differs, replace only those two
AIBoarding-owned files, then rerun classification. Do not rewrite config, state,
AGENTS.md, or CLAUDE.md. If current plugin assets cannot be located, route to
full revalidation. Repeating this refresh is byte-identical and rollback is safe:
older readers ignore the optional config and receipt fields.
Triage
Read last_synced_commit from .aiboarding/state.json (NOT from any instruction
file - the pointer lives only in the sidecar).
If state.json is missing or the pointer is missing/empty, the repo was never
properly synced or the state was lost (fresh clone of a repo where state was
gitignored, hand-edited state, or the drift hook fired as a repair signal). Do NOT
take the No-op branch - go straight to the Targeted-delta patch for a full
re-validation of all nine sections, then reseed state.json.
If the repo has AIBOARDING.md and no AGENTS.md, it is on the legacy layout:
stop and run migrate-aiboarding instead.
- Classify before reading semantics. Run the self-contained sibling
classify-drift --project <repo> --base <last_synced_commit> --head HEAD(or.aiboarding/tools/classify-driftif installed). Missing tool, invalid pointer, malformed report, rebased pointer, or changedHEADmeans full revalidation; never advance state from those outcomes. Its routes are unambiguous:irrelevantadvances state only;semantic-reviewneeds section evidence;mandatory-revalidationrequires applicable section revalidation; andinvalid-pointerrequires all nine sections. High-risk evidence always wins over ignored paths and cannot be downgraded by a semantic no-op. - Classify scope impact for every potentially relevant path against the
AGENTS.mdsections:Stack and Runtime/Build, Test, Run- stack, tooling, or commands changed?Architecture Map- boundaries, directories, data flow moved?Project Purpose/Domain Model- new concepts or changed behavior?Agent Guardrails/Known Failure Modes- new gotchas or constraints?Verification Before Completion/Escalation- done-criteria or stop-and-ask cases changed? Record each potential path's applicable sections and rationale. Only complete evidence covering every potential path can authorize--semantic complete-no-op. Semantic review may escalate scope, never hide deterministic high-risk evidence.
- Branch: classifier
irrelevant, or complete evidenced potential no-op → No-op. Mandatory route → Targeted-delta revalidation. Other routes → full revalidation.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 109 lines · 62 tokens per session scan A 16a885ca8d12
update-agent-onboarding is a skill published in the GitHub repository gustavo-meilus/aiboarding (2 stars, last pushed 11d ago), licensed MIT. It adds 62 tokens to every session and 1,532 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
setup-rootloom
Plan, install, inspect, update, or roll back Rootloom Personal Core in a user's Codex home. Supports Skills-only, guidance, and the recommended personal preset. Use when the user explicitly asks for a Rootloom setup plan, installation, configuration, bootstrap, repair, audit, status, update, reduction, rollback, or…
project-memory
Initialize, retrieve, and explicitly update the separate Rootloom Memory plugin's repository-owned architecture, risk, decision, and failure lessons. Use only when explicitly requested. Memory is experimental, advisory, and outside Rootloom Core.
operating-coding-change
The single Rootloom entry for code changes. Route Direct, Scoped, Governed, Evidence, and external-action work; repair owning invariants, preserve unrelated work, and report only verification that ran.
project-guidance
Seed, refresh, refine, or validate concise evidence-backed AGENTS.md guidance. Deterministic scripts own the managed block; model judgment may add only durable repository-specific invariants outside it.
operating-code-review
Review code, diffs, pull requests, migrations, or architecture without modifying files. Lead with severity-ranked evidence-backed findings, challenge root-cause claims, and disclose cleared and unreviewed scope.
dayu-harness
A one-time deployment tool that adds a project governance system built around AGENTS.md, project instructions, documentation, hooks, continuous integration, and maintenance scripts.