Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Lion-1209/coderio --skill onboarding-unknown-codebasegit clone --depth 1 https://github.com/Lion-1209/coderioWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/lion-1209/coderio/onboarding-unknown-codebase)<a href="https://agentmods.dev/skills/lion-1209/coderio/onboarding-unknown-codebase"><img src="https://agentmods.dev/badge/skills/lion-1209/coderio/onboarding-unknown-codebase/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/lion-1209/coderio/onboarding-unknown-codebase"><img src="https://agentmods.dev/badge/skills/lion-1209/coderio/onboarding-unknown-codebase.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00021 | $0.01408 |
| Opus 5.5 | $0.00008 | $0.00563 |
| Sonnet 5.5 | $0.00004 | $0.00282 |
| Haiku 4.5 | $0.00002 | $0.00141 |
Grade A, and why
onboarding-unknown-codebase scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
1 near-identical copy found in the catalogue:
- onboarding-unknown-codebase — 86% identical, 5 lines differ
How it starts
The opening of the file, as written. The whole thing — 96 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Onboarding Unknown Codebase
概述
用一套分层流程把陌生代码库变成一张"项目地图"，而不是一头扎进某个文件读细节。核心：先建立全局心智模型，再按需深入。
何时使用
- clone 了新项目，不知从哪读起
- 接手别人的代码（同事离职、新入职）
- 要给别人讲清楚一个项目
- 想搞清某个项目的整体架构/数据流
不该用：只想找某个具体函数/bug（直接搜）；项目你已经熟了。
核心内容
先确认对象（前置）
三遍法假设你已经拿到目标代码库。但用户常只说"帮我梳理这个项目""讲讲这个代码库"却没给路径——这是高频形态。开跑前先确认对象：
- 有明确本地路径或 git 地址 → 直接进入三遍法
- 没给 → 先向用户要：本地路径、git 地址、或至少
README.md+ 包管理清单（package.json/go.mod等）+ 顶层目录树（tree -L 2）。拿到这三样就能完成第一遍宏观 + 第二遍结构骨架 - 不要默认当前工作目录就是目标，更不要凭空臆造一个项目来梳理——那会跑题
三遍法
第一遍·宏观（5-10 分钟，别读代码） 读"元信息"文件，搞清"这是什么、技术栈、怎么跑"（按项目实际有的读，没有的就跳过）：
README.md—— 项目用途、怎么跑起来- 包管理清单：
package.json/go.mod/Cargo.toml/requirements.txt—— 技术栈、依赖 Dockerfile/docker-compose.yml—— 怎么部署（库/CLI 项目通常没有）- CI 配置：
.github/workflows/—— 怎么构建测试 - 配置：
.env.example、config/—— 运行时配置
第二遍·结构（10-15 分钟） 看目录布局和分层，建立"地图骨架"：
- 顶层目录各自负责什么？（
src/源码、tests/测试、docs/文档） - 分层模式：前后端分离？MVC？分层架构？
- 入口在哪？（
main、index、app、server；库/CLI 项目最快的方式是看package.json的bin和exports字段） - 模块之间怎么依赖（谁调用谁）
第三遍·主线（15-30 分钟） 从入口顺一条核心调用链读到底，不求全：
- 入口启动后，处理一个典型请求/操作，经过哪些模块？
- 只读主干，遇到分支先标记跳过
- 这条链路走通，就理解了项目的"骨架动力"
不同项目类型的主线形态不同——别用同一把尺子：
| 类型 | 入口找法 | 主线追踪什么 |
|---|---|---|
| 服务型（web/api） | server.listen / app.run / 路由表 |
一次请求的链路：HTTP 进来 → 中间件 → controller/handler → service → 数据层 → 响应 |
| 库 / SDK | package.json 的 exports、go.mod 主包、__init__.py 暴露的符号 |
一次典型函数调用：公开 API 入口 → 内部参数校验 → 核心算法/数据变换 → 返回值组装 |
| CLI | bin 字段、main 函数、命令注册表 |
一次典型命令的执行：参数解析 → 子命令分发 → 业务逻辑 → 输出/副作用 |
库项目的常见坑是"没有明显的请求入口"——这时从**公开 API（exports/导出符号）**切入，挑一个最常用的函数，顺它的调用栈读到底，等价于服务型项目的"一次请求"。
产出：项目地图
给用户一份结构化地图（不是流水账）：
## 这是什么 <一两句：项目用途>
## 技术栈 <语言、框架、关键依赖>
## 目录结构 <顶层目录职责 + 入口位置>
## 核心流程 <从入口出发的主调用链，逐步>
## 关键文件 <最重要的 3-5 个文件及职责>
## 怎么跑起来 <安装、配置、启动命令>
重要：标注信息来源。 项目地图里的每一条信息，标明它是来自文档（README/架构文档/git log） 还是来自源码（实际 read_file 读到的）。如果某条信息只来自文档、还没读源码确认，标注"（待源码 确认）"。这样你不会把文档描述当成源码事实，也不会因为发现"文档说的和源码不一样"而推翻整个 分析重来——直接标注差异即可。
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 96 lines · 21 tokens per session scan A e1c3e0d3fa61
onboarding-unknown-codebase is a skill published in the GitHub repository Lion-1209/coderio (9 stars, last pushed 7d ago), licensed MIT. It adds 21 tokens to every session and 1,408 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
playwright-cli
Automates browser interactions for web testing, form filling, screenshots, and data extraction using playwright-cli. Use when the user needs to navigate websites, interact with web pages, fill forms, take screenshots, test web applications, extract information from web pages, mock network requests, manage browser…
stuck
Diagnose frozen, stuck, or slow Qwen Code sessions on this machine. Scans for problematic processes, high CPU/memory usage, hung subprocesses, and debug logs. Use /stuck or /stuck to focus on a specific process.
structured-debugging
Hypothesis-driven debugging methodology for hard bugs. Use this skill whenever you're investigating non-trivial bugs, unexpected behavior, flaky tests, or tracing issues through complex systems. Activate proactively when debugging requires more than a quick glance — especially when the first attempt at a fix didn't…
desktop-brand-builder
Generate a branded Qwen Code desktop package from the Tauri desktop shell using a minimal brandId and logo. Use when the user wants a custom, white-label, or rebranded desktop client, installer, DMG/EXE/AppImage/deb, or one-click brand build on top of packages/desktop.
batch-api
Prepare a many-file, single-turn transform (translate, rewrite, extract) as a plan and submit it to the asynchronous, half-price DashScope Batch API; results are delivered as new files hours later. Invoke explicitly with /batch-api.
repo-hygiene
Use when the scheduled repo-hygiene workflow runs from GitHub Actions (or an operator dry-run) to scan the repository for small, certain docs/test/code hygiene issues and fix them as one batched branch.