Borrowing it
Nothing to install: this file belongs to Ramsbaby/jarvis. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/Ramsbaby/jarvis/main/.claude/skills/onboarding/SKILL.mdgit clone --depth 1 https://github.com/Ramsbaby/jarvisWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ramsbaby/jarvis/onboarding)<a href="https://agentmods.dev/skills/ramsbaby/jarvis/onboarding"><img src="https://agentmods.dev/badge/skills/ramsbaby/jarvis/onboarding.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 16 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 44 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 162 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 151 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 152 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 275 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 347 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 407 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- medium Rogue Agent · line 306 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 307 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 308 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 333 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 284 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 306 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 307 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 308 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 409 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00075 | $0.03774 |
| Opus 5 | $0.00037 | $0.01887 |
| Sonnet 5 | $0.00015 | $0.00755 |
| Haiku 4.5 | $0.00007 | $0.00377 |
Grade A, and why
onboarding scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -sf http://localhost:11434/api/tags > /dev/null && echo "ollama_ok" || echo "ollama_missing" How it starts
The opening of the file, as written. The whole thing — 411 lines — stays where its author put it; the contents beside it link to each section on GitHub.
🛸 Jarvis Onboarding 마법사
Jarvis를 처음 설치할 때 실행하는 대화형 설정 도우미입니다. 아래 절차를 순서대로 진행하세요.
Step 0: 사전 환경 확인
node --version # v18 이상 필요
git --version # 설치 확인
- Node 18 미만이면 사용자에게 업그레이드 안내 후 중단.
- git 없으면 설치 안내 후 중단.
Ollama 상태 확인 (RAG 기능 선택):
curl -sf http://localhost:11434/api/tags > /dev/null && echo "ollama_ok" || echo "ollama_missing"
- Ollama가 없으면 "RAG 기능은 나중에 설정 가능합니다" 안내하고 계속 진행 (중단 아님).
Step 1: 환경 파일 현황 확인
node .claude/skills/onboarding/scripts/check-setup.mjs
출력 예시:
{
"envPath": "~/jarvis/runtime/.env",
"missing": ["DISCORD_TOKEN", "ANTHROPIC_API_KEY", "GUILD_ID"],
"present": ["BOT_HOME"],
"updatePolicy": null
}
결과에 따른 분기:
| 상태 | 조건 | 처리 |
|---|---|---|
| 완전 신규 | missing에 항목 있음 | Steps 2~14 순서대로 진행 |
| 환경 설정됨, 정책 없음 | missing 비어있음 + updatePolicy null | Steps 2~5 스킵 → Step 9(정책 설정)로 이동 |
| 완전 설치됨 | missing 비어있음 + updatePolicy 있음 | "이미 설치된 환경입니다." 안내 후 선택 요청: [V] 검증만 실행 → Step 12로 이동 (읽기 전용, 자동 수정 없음) [U] 특정 값 업데이트 → 변경할 키 확인 → 해당 Step(2~5)에서 값 입력받기 → Step 6 케이스 B(--merge)로 저장 → Step 10(채널 ID 확인) → Step 11(--skip-if-loaded로 누락 에이전트만 추가) → Step 12(검증) [R] 완전 재설치 → Step 2부터 진행 |
check-setup 결과를 변수로 보관: 이후 Steps에서
missing배열과updatePolicy값을 참조합니다.
Step 2: Discord Bot Token
missing에DISCORD_TOKEN이 없으면 이 단계를 스킵합니다.
사용자에게 안내:
Discord Developer Portal(https://discord.com/developers/applications) 에서
봇의 TOKEN을 복사해 붙여넣으세요.
입력받은 값을 DISCORD_TOKEN 변수에 저장. 유효성 검증 (형식만, API 호출 없이):
- 길이 70자 이상, . 2개 포함 여부 확인.
- 실패 시 "올바른 형식이 아닙니다" 안내 후 재입력 요청.
Step 3: Anthropic API Key
missing에ANTHROPIC_API_KEY가 없으면 이 단계를 스킵합니다.
사용자에게 안내:
Anthropic Console(https://console.anthropic.com/settings/keys) 에서
API 키를 복사해 붙여넣으세요. (sk-ant-... 형식)
입력받은 값을 ANTHROPIC_API_KEY 변수에 저장. 형식 확인: sk-ant- 로 시작하는지 확인.
Step 4: Discord 서버 ID (GUILD_ID)
missing에GUILD_ID가 없으면 이 단계를 스킵합니다.
사용자에게 안내:
Discord 앱에서 서버 이름 우클릭 → 서버 ID 복사를 눌러 붙여넣으세요.
(개발자 모드가 꺼져 있다면: 설정 → 고급 → 개발자 모드 활성화 필요)
What ships with it
8 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- scripts/check-setup.mjs 1.4 KB runs code
- scripts/copy-config-templates.mjs 1.8 KB runs code
- scripts/create-update-channel.mjs 4.8 KB runs code
- scripts/install-launch-agents.mjs 6.6 KB runs code
- scripts/install-release-checker.mjs 3.7 KB runs code
- scripts/save-update-policy.mjs 2.1 KB runs code
- scripts/verify-setup.mjs 3.4 KB runs code
- scripts/write-env.mjs 4.5 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 411 lines · 75 tokens per session scan A 7ff026df316e
onboarding is a skill published in the GitHub repository Ramsbaby/jarvis (16 stars, last pushed 15d ago), licensed MIT. It adds 75 tokens to every session and 3,774 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
cognition-authority
How to hold the controls of the Cognition Discord server — you are the first actor there, not an assistant waiting for instructions. Read this before any other Cognition skill and before the first action of any session touching guild 1535979812860993617. It settles who decides, how to read a request as intent rather…
build-system
A skill for building interactive systems in the Cognition Discord server by combining Registry building blocks instead of writing code. These systems can include tickets, applications, voting, verification, and menus for choosing roles.
registry-authoring
A reference for the Cognition Registry, including its action types, parameters, conditions, template variables, and known configuration mistakes.
schedule-work
A scheduling skill for the Cognition Discord server. It chooses between a bot scheduler that runs continuously through fixed steps and a Claude routine that needs the app open but can make judgements.
server-read
Read the live state of the Cognition Discord server before changing it, and know what the read cannot tell you. Use at the start of any turn that will alter structure, and whenever a report about the server is wanted. Every other Cognition skill reasons from this output. Reads only — changes nothing. Triggers on: وش…
danger
A safety protocol for irreversible operations on a Cognition server, such as deleting a channel, category, or role. It requires taking a snapshot, previewing the change, getting human approval, and then applying it.