What is tend-onboard?

An onboarding skill for SvelteKit and TypeScript repositories. It examines the project and records which supported tools and features are present in a configuration file.

Setting up Tend in a repository, detecting its stack and applicable capability modules, and optionally installing its unattended review workflow.

It gives related Tend skills information about the repository's technology choices, so they can apply the right level of guidance instead of using generic defaults.

tend-onboard — Skill for Claude Code by robcsaszar/tend

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add robcsaszar/tend --skill tend-onboard

Clone the repo

git clone --depth 1 https://github.com/robcsaszar/tend

Made for: Claude Code.

Or install robcsaszar-tend, the plugin that ships this one along with the rest of its 7 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/robcsaszar/tend/tend-onboard/github.svg)](https://agentmods.dev/skills/robcsaszar/tend/tend-onboard)

Your own site

<a href="https://agentmods.dev/skills/robcsaszar/tend/tend-onboard"><img src="https://agentmods.dev/badge/skills/robcsaszar/tend/tend-onboard/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/robcsaszar/tend/tend-onboard"><img src="https://agentmods.dev/badge/skills/robcsaszar/tend/tend-onboard.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 98 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 2,118 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00098	$0.02118
Opus 5.5	$0.00039	$0.00847
Sonnet 5.5	$0.00020	$0.00424
Haiku 4.5	$0.00010	$0.00212

Measured 1mo ago against content hash 0551fca5048f, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

tend-onboard scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

The scan reads SKILL.md. This mod also ships 1 executable file (scripts/validate-config.mjs), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/tend-onboard/SKILL.md · 79 lines

How it starts

The opening of the file, as written. The whole thing — 79 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Tend Onboard — the installer

Detect this repo's stack, determine which capability modules apply, and write .claude/tend/config.yaml so the other tend-* skills stop running at conservative core-tier defaults. Runs once per install (or after a stack change) — not a scanning skill itself.

Phase 1 — Investigate

Spawn a single Explore-subagent investigation of the repo (the same shape as do-security-audit's Phase 1 stack triage, but broader): read package.json, lockfile, config files (svelte.config.js, vite.config.ts, biome.json, .env.example), and grep for code signatures. The subagent should report back, not act — it makes no edits.

MANDATORY READ references/module-signals.md before spawning — the exact dependency and code-signature signals for each of the 5 capability modules.

Ask the subagent to report:

Core stack confirmation (SvelteKit + Svelte 5 + TS strict + Biome + Vitest + pnpm) — flag anything missing or different; a missing core piece means core-tier tend skills will need to fall back further than usual.
Which of the 5 modules apply, with evidence (dependency name + version, or file:line for pattern-only signatures).
Repo-knowledge seeds: existing off-limits conventions (generated files, vendored code, lockfiles), any naming pattern for "superseded" or "@deprecated" helpers, any existing feature-flag or auth-token module names worth recording.

Phase 2 — Resolve ambiguity

Dependency-detectable modules (data, validation, realtime) auto-activate on a confirmed dependency — no confirmation needed.

Pattern-only modules (auth, feature-flags) auto-activate only when the subagent found a clear code signature (a local token-signing function, a feature-flag constants module). If the signal is weak or absent, do not guess — ask the user once: "Does this repo have [auth / feature flags]? (y)es, activate manually / (n)o, skip." Never silently activate a pattern-only module on inference alone.

Read the full file on GitHub · 79 lines

Files

What ships with it

10 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

1mo ago First seen · 79 lines · 98 tokens per session scan A 0551fca5048f

Subscribe to this mod's changes

tend-onboard is a skill published in the GitHub repository robcsaszar/tend (0 stars, last pushed 1mo ago), licensed MIT. It adds 98 tokens to every session and 2,118 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Claude Code Productivity Security accessibility agent-skills code-quality refactoring

the-pragmatic-programmer

Apply Hunt and Thomas-inspired pragmatic programming rules when improving engineering judgment, feedback loops, DRY knowledge, orthogonality, automation, or adaptability.

ciembor/agent-rules-books · 36 tokens

agent-desktop

Operate desktop applications on macOS and Windows through native accessibility trees, using the agent-desktop CLI. Use when an AI agent must see or act on a desktop GUI: click buttons, fill forms, read UI state, navigate menus, toggle checkboxes, scroll, drag, type text, press shortcuts, take screenshots, manage…

lahfir/agent-desktop · 157 tokens

tend-onboard