Borrowing it
Nothing to install: this file belongs to robconery/kolea. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/robconery/kolea/main/.claude/skills/onboard/SKILL.mdgit clone --depth 1 https://github.com/robconery/koleaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/robconery/kolea/onboard)<a href="https://agentmods.dev/skills/robconery/kolea/onboard"><img src="https://agentmods.dev/badge/skills/robconery/kolea/onboard/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/robconery/kolea/onboard"><img src="https://agentmods.dev/badge/skills/robconery/kolea/onboard.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00131 | $0.04119 |
| Opus 5.5 | $0.00052 | $0.01648 |
| Sonnet 5.5 | $0.00026 | $0.00824 |
| Haiku 4.5 | $0.00013 | $0.00412 |
Grade A, and why
onboard scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
API call and every file write. Don't improvise `curl` or hand-edit How it starts
The opening of the file, as written. The whole thing — 313 lines — stays where its author put it; the contents beside it link to each section on GitHub.
🐦 /onboard
You are welcoming someone to Kōlea. They have just cloned the repo. They may know nothing about Cloudflare. By the end they should either be looking at it locally, or have it live on their own domain, having typed very little.
🧭 How to run this interview
- One question per message. Ask, wait, then ask the next. Never stack two
questions in one message. Use
AskUserQuestionwhenever the answer is a choice; ask plainly in text when it is free-form (a name, a hostname). - Offer a default for everything you can derive:
list.<their domain>for the admin host, their sending address as the login address, and so on. "Press enter forlist.example.com" beats an open question. - Say what you're about to do before you do it, in one line, and what it costs if it's slow.
- The script does the work.
bun scripts/onboard.ts <command>holds every API call and every file write. Don't improvisecurlor hand-editwrangler.jsonc. If a command fails, read its message out to the person in plain words and fix the cause. Don't paper over it. - Resume, don't restart. Answers live in
.onboard/state.json, secrets in.onboard/secrets.env(both gitignored, secrets mode 600). Start every run withbun scripts/onboard.ts status. If there's progress, say what's done and pick up at the first thing that isn't. - Record each answer as soon as you have it:
bun scripts/onboard.ts set KEY=value(quote values with spaces). Secrets go throughbun scripts/onboard.ts secret KEY=value, neverset.
🚨 Hard rules
These come from CLAUDE.md and they are not negotiable here either.
- Onboarding never sends email. Not a test, not a "just to check". The person does their own first test send from the admin, to themselves, after you hand over. Nothing you run should reach a provider's send endpoint.
- Nothing reaches production without an explicit yes, right then. Before
migrate,deployandsecrets, show what's about to happen and ask. An earlier yes doesn't carry over. - Always go through the script (it uses
--env production). A barewrangler deploypublishes the admin console with no login. - Never overwrite the upstream install. If
statusorrenderreports the upstreamwrangler.jsoncbelongs to the account the token opens, stop: this is Rob's own production, not a fresh clone. - Never echo a secret back into the conversation once it's stored. Say
"saved" and move on. The single exception is the admin API key that
seedprints once; they need to copy it. - If they paste a token into chat, that's allowed. Also offer the
alternative: open
.onboard/secrets.envin their editor and add the line themselves, then say "done".
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 313 lines · 131 tokens per session scan A c19cbb4fabfb
onboard is a skill published in the GitHub repository robconery/kolea (11 stars, last pushed 28d ago), licensed MIT. It adds 131 tokens to every session and 4,119 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-25.
Other skills, from other repositories
multiworker-gotchas
Fork and template gotchas (env import, routes, typegen, forms, D1, Turbo, HMR, new DO packages). Use when working on apps/web or durable-objects, or when behavior diverges from this stack’s conventions.
multiworker-workflow
Repo-root commands, typegen and typecheck cadence, lint, deploy, adding packages with bun, and Alchemy app layout. Use at the start of a task, before PR, or when choosing turbo/typegen commands.
workers-env-local
Alchemy + env files — repo-root .env.local (dev), .env.staging (staging / PR preview deploys), .env.production (prod / CI), optional per-package .env.local, and package-local Alchemy apps. Use when adding secrets or non-secret vars (must also update turbo.json globalEnv + deploy workflow env maps), or debugging…
binding-hono-client
Typed HTTP clients for Cloudflare service bindings — bindingHonoClient, WorkerBindingRegistry, Worker RPC with clientApp, HonoClientApp. Use when calling env.CHATROOM or any WorkerRef/BoundWorker over fetch with @firtoz/hono-fetcher, adding a worker Hono app RPC type, or fixing JsonResponse / missing .delete on…
project-init
Personalizes a fork of this Cloudflare multi-worker monorepo—Alchemy application ids (await alchemy literals + --app), npm workspace names (--filter), README, and UI—so Cloudflare dashboards and Turbo filters are not confusing. Use when the user created a repo from the template, wants to deploy their own app, or asks…
durable-object-package
Add or change a Durable Object worker package under durable-objects/ (Alchemy, env.d.ts, Hono on the DO). Use when scaffolding with turbo gen durable-object, editing durable-objects//alchemy.run.ts, workers/app.ts, or env.d.ts for a DO. Not for web app bindings or cross-worker rpc—see web-alchemy-bindings and…