What is inspecto-onboarding-core?

A shared workflow for maintainers who create or update Inspecto onboarding skills. Inspecto is a project setup tool, and the workflow guides its detection, planning, changes, and health checks.

Use it to onboard Inspecto in a project, choose the correct local development target, confirm planned changes, and complete required IDE setup.

It prevents each assistant-specific onboarding skill from handling project setup differently or editing configuration by hand.

inspecto-onboarding-core — Skill for Claude Code and Codex by inspecto

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add inspecto-dev/inspecto --skill inspecto-onboarding-core

Clone the repo

git clone --depth 1 https://github.com/inspecto-dev/inspecto

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/inspecto-dev/inspecto/inspecto-onboarding-core.svg)](https://agentmods.dev/skills/inspecto-dev/inspecto/inspecto-onboarding-core)

Your own site

<a href="https://agentmods.dev/skills/inspecto-dev/inspecto/inspecto-onboarding-core"><img src="https://agentmods.dev/badge/skills/inspecto-dev/inspecto/inspecto-onboarding-core.svg" alt="Measured on agentmods" height="20"></a>

Per session 32 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 1,105 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector warn 7 Sept 2026

SkillSpector: 2 findings, up to medium

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

medium Prompt Injection · line 52
Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Fix: Review content for implicit steering or bias. Ensure instructions are explicit and align with the skill's stated purpose.
medium MCP Rug Pull · line 60
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00032	$0.01105
Opus 5	$0.00016	$0.00553
Sonnet 5	$0.00006	$0.00221
Haiku 4.5	$0.00003	$0.00111

Measured 8d ago against content hash 1f8ba57d89bd, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-07, from the pricing page.

Security

Grade A, and why

inspecto-onboarding-core scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.

The scan reads SKILL.md. This mod also ships 1 executable file (scripts/run-inspecto.sh), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/inspecto-onboarding-core/SKILL.md · 68 lines

How it starts

The opening of the file, as written. The whole thing — 68 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Inspecto Onboarding Core

This is the shared onboarding workflow for assistant-specific Inspecto skills. It is a maintainer-facing reference, not the primary end-user entry point.

Scope

Use this workflow when an assistant skill needs to set up Inspecto in the current project without hand-editing project files.

Shared Flow

Run scripts/run-inspecto.sh onboard --json.
If the result returns status: "needs_target_selection", explain that this step chooses which local development build target should receive the Inspecto plugin and settings. Ask the user to choose one returned target candidate and rerun with --target <candidateId>, preferring the explicit candidateId field. The CLI also accepts a returned configPath as a compatibility fallback. Do not collapse the selection back to a package path when multiple build configs exist in the same package.
If the result returns status: "needs_confirmation", summarize summary and ask for approval before rerunning with --yes.
If the result returns status: "partial_success" and the remaining step is IDE extension installation, treat that as a required onboarding follow-up.
If IDE extension installation must be done manually, guide the user with the documented install path before moving on:
- Prefer the built-in marketplace search for Inspecto in the target IDE.
- Use launcher commands only when that IDE's CLI is actually available in the current shell, for example code --install-extension inspecto.inspecto, cursor --install-extension inspecto.inspecto, or another documented host-IDE launcher.
- If the launcher is unavailable, fall back to the documented marketplace links:
  - https://marketplace.visualstudio.com/items?itemName=inspecto.inspecto
  - https://open-vsx.org/extension/inspecto/inspecto
If the result returns status: "error", summarize diagnostics and run doctor --json only when explicit recovery diagnostics are still needed.
Only after the IDE extension step is complete, use the onboarding result's verification payload. If verification.available is true and verification.devCommand is present, offer to start that exact command for validation. Otherwise, tell the user to run their usual dev command manually using verification.message.
If the result includes handoff.patches, treat them as the primary source of truth for any remaining manual work. Apply the generated patches directly before exploring framework docs or unrelated project files.
Only do broader documentation or repo exploration when a returned patch is clearly insufficient or conflicts with the local project structure.
If the onboarding result includes handoff.dailyUsage, use that payload as the source of truth for post-onboarding runtime guidance:

Read the full file on GitHub · 68 lines

Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

scripts/run-inspecto.sh 1.9 KB runs code

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

8d ago First seen · 68 lines · 32 tokens per session scan A 1f8ba57d89bd

Subscribe to this mod's changes

inspecto-onboarding-core is a skill published in the GitHub repository inspecto-dev/inspecto (23 stars, last pushed 4d ago), licensed MIT. It adds 32 tokens to every session and 1,105 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Planning ai ai-assistant claude copilot cursor developer-tools

sdd-apply

Skill "sdd-apply" from Gentleman-Programming/gentle-ai, covering execution role, language domain contract, purpose, what you receive and execution and persistence contract.

Gentleman-Programming/gentle-ai · 0 tokens

gentle-ai-collab-perfect

Trigger: contributing to Gentleman-Programming/gentle-ai as an external collaborator. Strict issue-first workflow, honest PR bodies, contributor-vs-maintainer scope, chained-PR strategy, verification protocol, docstring coverage. Load whenever the active repo is Gentleman-Programming/gentle-ai and any part of the…

Gentleman-Programming/gentle-ai · 106 tokens

inspecto-onboarding-core