Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add okteto/okteto-agent-skills --skill okteto-onboardinggit clone --depth 1 https://github.com/okteto/okteto-agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/okteto/okteto-agent-skills/okteto-onboarding)<a href="https://agentmods.dev/skills/okteto/okteto-agent-skills/okteto-onboarding"><img src="https://agentmods.dev/badge/skills/okteto/okteto-agent-skills/okteto-onboarding/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/okteto/okteto-agent-skills/okteto-onboarding"><img src="https://agentmods.dev/badge/skills/okteto/okteto-agent-skills/okteto-onboarding.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 501 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00100 | $0.08318 |
| Opus 5 | $0.00050 | $0.04159 |
| Sonnet 5 | $0.00020 | $0.01664 |
| Haiku 4.5 | $0.00010 | $0.00832 |
Grade A, and why
okteto-onboarding scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 506 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Okteto Onboarding Skill
1. Activation
This skill activates when all of the following are true:
- The project has no
okteto.yamlorokteto.ymlat the repo root - The user is asking about Okteto, dev environments, or onboarding (e.g., "how do I get this onto Okteto", "set this repo up for Okteto", "create an Okteto manifest")
Do NOT activate if:
- An
okteto.yamlorokteto.ymlalready exists at the repo root — that is the existingoktetoskill's domain. Defer to it. - The user is asking how to use Okteto with an existing manifest. Defer to the existing
oktetoskill.
Pre-flight check. Before starting Phase 1, run:
ls okteto.yaml okteto.yml 2>/dev/null
If anything is returned, stop and tell the user:
"I see
okteto.yamlalready exists. Theokteto-onboardingskill is for repos without a manifest. For working with the existing manifest, use theoktetoskill or run/dev-setup."
Two operating modes: collaborative (default — user is in the loop) and autonomous (no human; opens a PR). See Section 7. Most of the workflow is mode-agnostic; only Phase 6 and the resolution of "ask the user" branches differ.
2. Phase 1 — Discover
Build an internal model of the repo: services, their build contexts, ports, dev commands, and any existing deploy artifacts. Read signals in priority order. Do not write the manifest yet.
2.1 Signal priority
docker-compose.yml/compose.yaml— the richest signal for services and dev, and a validdeploy:source on its own. If present, it is the primary blueprint forbuild:anddev:, and Okteto can deploy it directly viadeploy: compose:(Section 4.1) — no chart or k8s manifests required. See the mapping table below.- Existing Helm chart — any
Chart.yamlunderchart/,charts/,helm/, ordeploy/. If found,deploy:will be ahelm upgrade --installcommand. Do not generate or modify the chart. - Existing k8s manifests —
.yamlfiles withkind:headers underk8s/,manifests/,deploy/— but excluding anytemplates/subdirectory (those belong to a Helm chart and are not directly applyable). If found,deploy:will bekubectl apply -f .... Do not author these manifests. - Per-service Dockerfiles — for repos without compose, each top-level
Dockerfileis a candidate service. Service name comes from the parent directory. - Language manifests —
package.json,go.mod,pom.xml,pyproject.toml,Gemfile,Cargo.toml. Used to pick the dev image and infer the dev command. When this is the only signal (no Dockerfile, no compose), name the service after the project'snamefield (e.g.,pyproject.toml's[project] name,package.json'sname) or, failing that, the repo directory. - Procfile / Makefile — secondary signals when language manifests are ambiguous.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 506 lines · 100 tokens per session scan A c06ad31e06b2
okteto-onboarding is a skill published in the GitHub repository okteto/okteto-agent-skills (6 stars, last pushed 9d ago), licensed Apache-2.0. It adds 100 tokens to every session and 8,318 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
ksail
Use the ksail CLI to spin up and manage Kubernetes clusters (Kind/K3d/Talos/vCluster/KWOK — local via Docker; EKS — cloud via AWS) and GitOps workloads declaratively. Triggers on requests involving Kubernetes clusters, Flux/ArgoCD GitOps bootstrapping, Kind/K3d/Talos/vCluster/KWOK/EKS, multi-tenancy onboarding, OIDC…
project-tooling
Standard CLI tools for project infrastructure management.
memstack-deployment-domain-ssl
Use this skill when the user says 'setup domain', 'configure DNS', 'SSL certificate', 'domain-ssl', 'custom domain', 'HTTPS setup', or needs to configure DNS records, SSL certificates, and custom domains for any hosting provider. Do NOT use for full deployment workflows.
cluster-events
Analyze cluster-wide Kubernetes events to identify issues and patterns. Aggregates Warning events, detects high-frequency patterns, and correlates related events.
quota-debug
Diagnose Kubernetes native ResourceQuota and LimitRange admission rejections (exceeded quota, forbidden by LimitRange, FailedCreate). Checks namespace quotas, current usage, LimitRange constraints, and ReplicaSet events to identify why pods cannot be created. Not applicable to Volcano Queue — use…
ship
Use when code is ready to ship — creates PRs, merges, deploys, and verifies. Handles the full PR-to-production pipeline. Triggers on /ship.