ooda-setup

A three-step setup wizard for an OODA project that scans the codebase, detects development tools and endpoints, and creates config.json. A monorepo is one repository containing multiple related projects or packages.

In plain words
What is it for?
Use it after cloning OODA to detect the language, test framework, continuous-integration setup, endpoints, and monorepo structure, then create or update the project configuration.
Why use it?
It gathers common project settings automatically and offers overwrite, merge, or abort choices when configuration already exists.

Skill for Claude CodeCodex

Part of the ooda-loop plugin — 11 skills, 2 hooks shipped together

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/mataeil/ooda-loop/ooda-setup
Any agent
npx skills add mataeil/OODA-loop --skill ooda-setup
Clone the repo
git clone --depth 1 https://github.com/mataeil/OODA-loop

Made for: Claude Code, Codex.

Or install ooda-loop, the plugin that ships this one along with the rest of its 11 skills, 2 hooks.

Per session 32 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 3,746 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00032 $0.03746
Opus 5 $0.00016 $0.01873
Sonnet 5 $0.00006 $0.00749
Haiku 4.5 $0.00003 $0.00375

Measured 2d ago against content hash 80cd98df95a3, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

ooda-setup scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

2. **service_health**: If `config.health_endpoints` is non-empty, curl each endpoint
skills/ooda-setup/SKILL.md · 320 lines

How it starts

The opening of the file, as written. The whole thing — 320 lines — stays where its author put it; the contents beside it link to each section on GitHub.

ooda-setup — Project Setup Wizard

Entry point for new users. Run /ooda-setup after cloning OODA-loop. Runs a 3-step interactive wizard: scan → confirm domains → write config.json.


Safety Check (Always First)

Read agent/safety/HALT. If the file exists → print [HALT] Setup blocked. Remove agent/safety/HALT to continue. and stop immediately.

If config.json already exists → back up to config.json.bak and ask:

[WARNING] config.json already exists.
  (o) Overwrite — discard current config, start fresh
  (m) Merge     — keep existing domains and safety settings, update detected values only
  (a) Abort     — cancel setup
  Choice (o/m/a):
  • o → overwrite entirely (backed up to config.json.bak)
  • m → read existing config, preserve user-modified fields (domains, safety, progressive_complexity.current_level, cost), only update auto-detected values (project.name, test_command, deploy_workflow, health_endpoints)
  • a or anything else → abort

Step 1/3: Scan Project

Print: [1/3] Scanning your project...

Detect Monorepo — before language detection, check for monorepo indicators:

  • package.json has "workspaces" field → npm/yarn workspaces monorepo
  • pnpm-workspace.yaml exists → pnpm monorepo
  • lerna.json exists → Lerna monorepo
  • packages/ or apps/ directory exists with multiple sub-package.json files → probable monorepo

If monorepo detected, scan each workspace root for its own indicator files and aggregate results. Print:

  Structure: monorepo ({N} packages detected)

If not a monorepo, print Structure: single-package.

For monorepos, auto-detect values from the root config first, then fall back to the first workspace that has the relevant indicator. Use the root package.json scripts for test/build commands unless a workspace-level override exists.

Detect Language — use Glob to check for indicator files:

Indicator Language
package.json TypeScript (if *.ts files exist) or JavaScript
go.mod Go
Cargo.toml Rust
pyproject.toml / requirements.txt Python
Gemfile Ruby
pom.xml / build.gradle Java

Read the full file on GitHub · 320 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 320 lines · 32 tokens per session scan A 80cd98df95a3

Subscribe to this mod's changes

ooda-setup is a skill published in the GitHub repository mataeil/OODA-loop (5 stars, last pushed 2mo ago), licensed MIT. It adds 32 tokens to every session and 3,746 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

security-ownership-map

Analyze git repositories to build a security ownership topology (people-to-file), compute bus factor and sensitive-code ownership, and export CSV/JSON for graph databases and visualization. Trigger only when the user explicitly wants a security-oriented ownership or bus-factor analysis grounded in git history (for…

HKUDS/DeepCode · 99 tokens

integrity-forensics

Run the Anti-Autoresearch integrity-forensics sweep (span-anchored evidence ledger → GPT auditors propose findings → a rules-only reporter that lists every proposal with what the auditor said about it) against a paper via a SHA-pinned thin launcher — then convert the verdict into a typed policy gate…

wanshuiyin/Auto-claude-code-research-in-sleep · 162 tokens

patent-novelty-check

Assess patent novelty and non-obviousness against prior art. Use when user says "专利查新", "patent novelty", "可专利性评估", "patentability check", or wants to evaluate if an invention is patentable.

wanshuiyin/Auto-claude-code-research-in-sleep · 59 tokens

flow-next-tracker-sync

Project a flow-next spec to a tracker issue (Linear, GitHub, GitLab, Jira) and reconcile two-way. Use when asked to sync to a tracker. NOT plan-sync.

gmickel/flow-next · 44 tokens

flow-next-export-context

Export RepoPrompt context to a markdown file for review with an external LLM (ChatGPT, Claude web, etc.). Use when you want Carmack-level review but prefer an external model. Triggers on "export context", "export for external review", "export plan for ChatGPT", "export impl review context", "review with an external…

gmickel/flow-next · 81 tokens

moai-ref-ui-polish

UI polish and interface-completion reference: the small visual details — concentric border radius, optical alignment, shadow-vs-border, motion easing, typography smoothing, tabular numbers, icon stroke weight, hit areas — that separate polished interfaces from generic ones. Agent-extending skill that amplifies…

modu-ai/moai-adk · 98 tokens