Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/rahmanef63/si-coder-agent/sc-onboardingnpx skills add rahmanef63/si-coder-agent --skill sc-onboardinggit clone --depth 1 https://github.com/rahmanef63/si-coder-agentWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/rahmanef63/si-coder-agent/sc-onboarding)<a href="https://agentmods.dev/skills/rahmanef63/si-coder-agent/sc-onboarding"><img src="https://agentmods.dev/badge/skills/rahmanef63/si-coder-agent/sc-onboarding.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00064 | $0.03004 |
| Opus 5 | $0.00032 | $0.01502 |
| Sonnet 5 | $0.00013 | $0.00601 |
| Haiku 4.5 | $0.00006 | $0.00300 |
Grade D, and why
sc-onboarding scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
N --> O[Write ~/.bashrc<br/>chmod 0600] Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
bash install.sh --no-onboard # symlink only; never prompt (CI / curl | bash) Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
bash install.sh --no-onboard # symlink only; never prompt (CI / curl | bash) How it starts
The opening of the file, as written. The whole thing — 207 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/sc-onboarding — Guided credential setup
Use this skill when the user is setting up si-coder-agent for the first time, or after they install a new /sc-* domain skill that needs new credentials.
The sc console (preferred entry point)
sc providers what is configured, per provider
sc providers show <id> per-var detail + where to get each value
sc providers set <id> re-enter (rotate) every var for one provider
sc providers rm <id> remove its vars from the ~/.bashrc managed block
sc setup [--target t] interactive wizard for whatever is missing
sc doctor [--target t] LIVE check — calls each real API
sc preflight --target t the gate /sc-all runs
Everything that picks something is arrow-key driven — no retyping identifiers that are already on screen, and no silent typos:
scwith no arguments opens the console menu (on a pipe it still prints usage, so scripts are unaffected).sc setupshows a checkbox list of all providers with whatever is incomplete pre-ticked.↑/↓move ·Spacetoggle ·aall/none ·Enterconfirm ·Esccancel. (j/kwork too.)sc providers show|set|rmwith no id opens a single-select list.
Values themselves are still typed — a token has to be pasted — but secrets are read hidden and never reach argv.
More than one identity: profiles + sc.md
One ~/.bashrc holds one set of credentials. That breaks the moment two machines, two
Cloudflare accounts, or two clients are in play — and the failure is silent: a stale export
from a login shell is enough to deploy with the wrong account's token.
sc user profiles + which one governs this directory
sc user which the resolution, and why
sc user add <name> [--from-shell] create one (--from-shell imports what is exported now)
sc user use <name> set the fallback profile
sc user map <folder> <name> bind a folder AND its children to a profile
sc user unmap <folder> drop that rule
sc user rm <name> [--yes] delete a profile and its credentials
sc env eval "$(sc env)" — apply it to the current shell
sc run -- <cmd> ... run one command under the resolved profile
--no-profile ignore profiles for this one command
What ships with it
14 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- lib/onboarding-domains.js 2.2 KB runs code
- scripts/scan-env.js 8.5 KB runs code
- steps/cf.md 767 B
- steps/clerk.md 1.2 KB
- steps/convex-cloud.md 897 B
- steps/convex.md 662 B
- steps/dokploy.md 905 B
- steps/github.md 978 B
- steps/hostinger.md 850 B
- steps/resend.md 657 B
- steps/stripe.md 1.0 KB
- steps/supabase.md 1.0 KB
- steps/sync.md 2.8 KB
- steps/vercel.md 823 B
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 207 lines · 64 tokens per session scan D 22d2a7a50a9b
sc-onboarding is a skill published in the GitHub repository rahmanef63/si-coder-agent (14 stars, last pushed 7d ago), licensed MIT. It adds 64 tokens to every session and 3,004 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it D with 3 findings (asks for root, downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
convex-create-component
Designs and builds Convex components with isolated tables, clear boundaries, and app-facing wrappers. Use this skill when creating a new Convex component, extracting reusable backend logic into a component, building a third-party integration that owns its own tables, packaging Convex functionality for reuse, or when…
convex-quickstart
Initializes a new Convex project from scratch or adds Convex to an existing app. Use this skill when starting a new project with Convex, scaffolding with npm create convex@latest, adding Convex to an existing React, Next.js, Vue, Svelte, or other frontend, wiring up ConvexProvider, configuring environment variables…
convex-performance-audit
Audits and optimizes Convex application performance across hot-path reads, write contention, subscription cost, and function limits. Use this skill when a Convex feature is slow or expensive, npx convex insights shows high bytes or documents read, OCC conflict errors or mutation retries appear, subscriptions or UI…
convex-setup-auth
Sets up Convex authentication with user management, identity mapping, and access control. Use this skill when adding login or signup to a Convex app, configuring Convex Auth, Clerk, WorkOS AuthKit, Auth0, or custom JWT providers, wiring auth.config.ts, protecting queries and mutations with ctx.auth.getUserIdentity()…
convex-migration-helper
Plans and executes safe Convex schema and data migrations using the widen-migrate-narrow workflow and the @convex-dev/migrations component. Use this skill when a deployment fails schema validation, existing documents need backfilling, fields need adding or removing or changing type, tables need splitting or merging…
robel-auth
Integrate and maintain Robelest Convex Auth in apps by always checking upstream before implementation. Use when adding auth setup, updating auth wiring, migrating between upstream patterns, or troubleshooting @robelest/convex-auth behavior across projects.