Borrowing it
Nothing to install: this file belongs to Ramsbaby/jarvis. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/Ramsbaby/jarvis/standalone/.claude/skills/onboarding/SKILL.mdgit clone --depth 1 https://github.com/Ramsbaby/jarvisWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ramsbaby/jarvis/onboarding)<a href="https://agentmods.dev/skills/ramsbaby/jarvis/onboarding"><img src="https://agentmods.dev/badge/skills/ramsbaby/jarvis/onboarding/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ramsbaby/jarvis/onboarding"><img src="https://agentmods.dev/badge/skills/ramsbaby/jarvis/onboarding.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 16 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 44 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 162 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 151 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 152 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 275 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 347 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 407 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- medium Rogue Agent · line 306 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 307 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 308 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 333 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 284 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 306 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 307 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 308 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 409 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00075 | $0.03774 |
| Opus 5.5 | $0.00030 | $0.01510 |
| Sonnet 5.5 | $0.00015 | $0.00755 |
| Haiku 4.5 | $0.00007 | $0.00377 |
Grade A, and why
onboarding scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -sf http://localhost:11434/api/tags > /dev/null && echo "ollama_ok" || echo "ollama_missing" How it starts
The opening of the file, as written. The whole thing — 411 lines — stays where its author put it; the contents beside it link to each section on GitHub.
🛸 Jarvis Onboarding 마법사
Jarvis를 처음 설치할 때 실행하는 대화형 설정 도우미입니다. 아래 절차를 순서대로 진행하세요.
Step 0: 사전 환경 확인
node --version # v18 이상 필요
git --version # 설치 확인
- Node 18 미만이면 사용자에게 업그레이드 안내 후 중단.
- git 없으면 설치 안내 후 중단.
Ollama 상태 확인 (RAG 기능 선택):
curl -sf http://localhost:11434/api/tags > /dev/null && echo "ollama_ok" || echo "ollama_missing"
- Ollama가 없으면 "RAG 기능은 나중에 설정 가능합니다" 안내하고 계속 진행 (중단 아님).
Step 1: 환경 파일 현황 확인
node .claude/skills/onboarding/scripts/check-setup.mjs
출력 예시:
{
"envPath": "~/jarvis/runtime/.env",
"missing": ["DISCORD_TOKEN", "ANTHROPIC_API_KEY", "GUILD_ID"],
"present": ["BOT_HOME"],
"updatePolicy": null
}
결과에 따른 분기:
| 상태 | 조건 | 처리 |
|---|---|---|
| 완전 신규 | missing에 항목 있음 | Steps 2~14 순서대로 진행 |
| 환경 설정됨, 정책 없음 | missing 비어있음 + updatePolicy null | Steps 2~5 스킵 → Step 9(정책 설정)로 이동 |
| 완전 설치됨 | missing 비어있음 + updatePolicy 있음 | "이미 설치된 환경입니다." 안내 후 선택 요청: [V] 검증만 실행 → Step 12로 이동 (읽기 전용, 자동 수정 없음) [U] 특정 값 업데이트 → 변경할 키 확인 → 해당 Step(2~5)에서 값 입력받기 → Step 6 케이스 B(--merge)로 저장 → Step 10(채널 ID 확인) → Step 11(--skip-if-loaded로 누락 에이전트만 추가) → Step 12(검증) [R] 완전 재설치 → Step 2부터 진행 |
check-setup 결과를 변수로 보관: 이후 Steps에서
missing배열과updatePolicy값을 참조합니다.
Step 2: Discord Bot Token
missing에DISCORD_TOKEN이 없으면 이 단계를 스킵합니다.
사용자에게 안내:
Discord Developer Portal(https://discord.com/developers/applications) 에서
봇의 TOKEN을 복사해 붙여넣으세요.
입력받은 값을 DISCORD_TOKEN 변수에 저장. 유효성 검증 (형식만, API 호출 없이):
- 길이 70자 이상, . 2개 포함 여부 확인.
- 실패 시 "올바른 형식이 아닙니다" 안내 후 재입력 요청.
Step 3: Anthropic API Key
missing에ANTHROPIC_API_KEY가 없으면 이 단계를 스킵합니다.
사용자에게 안내:
Anthropic Console(https://console.anthropic.com/settings/keys) 에서
API 키를 복사해 붙여넣으세요. (sk-ant-... 형식)
입력받은 값을 ANTHROPIC_API_KEY 변수에 저장. 형식 확인: sk-ant- 로 시작하는지 확인.
Step 4: Discord 서버 ID (GUILD_ID)
missing에GUILD_ID가 없으면 이 단계를 스킵합니다.
사용자에게 안내:
Discord 앱에서 서버 이름 우클릭 → 서버 ID 복사를 눌러 붙여넣으세요.
(개발자 모드가 꺼져 있다면: 설정 → 고급 → 개발자 모드 활성화 필요)
What ships with it
8 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- scripts/check-setup.mjs 1.4 KB runs code
- scripts/copy-config-templates.mjs 1.8 KB runs code
- scripts/create-update-channel.mjs 4.8 KB runs code
- scripts/install-launch-agents.mjs 6.6 KB runs code
- scripts/install-release-checker.mjs 3.7 KB runs code
- scripts/save-update-policy.mjs 2.1 KB runs code
- scripts/verify-setup.mjs 3.4 KB runs code
- scripts/write-env.mjs 4.5 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 411 lines · 75 tokens per session scan A 7ff026df316e
onboarding is a skill published in the GitHub repository Ramsbaby/jarvis (20 stars, last pushed 5d ago), licensed MIT. It adds 75 tokens to every session and 3,774 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
hyperframes
Create video compositions, animations, title cards, overlays, captions, voiceovers, audio-reactive visuals, and scene transitions in HyperFrames HTML. Use when asked to build any HTML-based video content, add captions or subtitles synced to audio, generate text-to-speech narration, create audio-reactive animation…
security-audit
Answer security questions about code, review a file or change for vulnerabilities, or run a full multi-agent audit of a codebase with a coverage ledger and independently verified findings.
cli-anything
Drive desktop apps (LibreOffice, GIMP, Blender, Inkscape, Audacity, Draw.io, Kdenlive, Shotcut, Krita, FreeCAD, MuseScore) headless through CLI-Anything harnesses with JSON output, instead of clicking through the app window with nativeapp.
hyperframes-cli
HyperFrames CLI tool — hyperframes init, lint, preview, render, transcribe, tts, doctor, browser, info, upgrade, compositions, docs, benchmark. Use when scaffolding a project, linting or validating compositions, previewing in the studio, rendering to video, transcribing audio, generating TTS, or troubleshooting the…
hyperframes-registry
Install and wire registry blocks and components into HyperFrames compositions. Use when running hyperframes add, installing a block or component, wiring an installed item into index.html, or working with hyperframes.json. Covers the add command, install locations, block sub-composition wiring, component snippet…
architecture-design
Orchestrate an architectural concept workflow across Rhino, Blender, and ComfyUI connectors.