Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add robcsaszar/tend --skill tend-onboardgit clone --depth 1 https://github.com/robcsaszar/tendWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/robcsaszar/tend/tend-onboard)<a href="https://agentmods.dev/skills/robcsaszar/tend/tend-onboard"><img src="https://agentmods.dev/badge/skills/robcsaszar/tend/tend-onboard.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00098 | $0.02118 |
| Opus 5 | $0.00049 | $0.01059 |
| Sonnet 5 | $0.00020 | $0.00424 |
| Haiku 4.5 | $0.00010 | $0.00212 |
Grade A, and why
tend-onboard scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 79 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Tend Onboard — the installer
Detect this repo's stack, determine which capability modules apply, and write .claude/tend/config.yaml so the other tend-* skills stop running at conservative core-tier defaults. Runs once per install (or after a stack change) — not a scanning skill itself.
Phase 1 — Investigate
Spawn a single Explore-subagent investigation of the repo (the same shape as do-security-audit's Phase 1 stack triage, but broader): read package.json, lockfile, config files (svelte.config.js, vite.config.ts, biome.json, .env.example), and grep for code signatures. The subagent should report back, not act — it makes no edits.
MANDATORY READ references/module-signals.md before spawning — the exact dependency and code-signature signals for each of the 5 capability modules.
Ask the subagent to report:
- Core stack confirmation (SvelteKit + Svelte 5 + TS strict + Biome + Vitest + pnpm) — flag anything missing or different; a missing core piece means core-tier tend skills will need to fall back further than usual.
- Which of the 5 modules apply, with evidence (dependency name + version, or file:line for pattern-only signatures).
- Repo-knowledge seeds: existing off-limits conventions (generated files, vendored code, lockfiles), any naming pattern for "superseded" or "@deprecated" helpers, any existing feature-flag or auth-token module names worth recording.
Phase 2 — Resolve ambiguity
Dependency-detectable modules (data, validation, realtime) auto-activate on a confirmed dependency — no confirmation needed.
Pattern-only modules (auth, feature-flags) auto-activate only when the subagent found a clear code signature (a local token-signing function, a feature-flag constants module). If the signal is weak or absent, do not guess — ask the user once: "Does this repo have [auth / feature flags]? (y)es, activate manually / (n)o, skip." Never silently activate a pattern-only module on inference alone.
What ships with it
10 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- assets/tend-sweep.yml 8.6 KB
- evals/eval-1/assertions.md 1023 B
- evals/eval-1/prompt.md 73 B
- evals/eval-2/assertions.md 661 B
- evals/eval-2/prompt.md 80 B
- evals/eval-3/assertions.md 742 B
- evals/eval-3/prompt.md 150 B
- references/config-schema.md 2.5 KB
- references/module-signals.md 3.5 KB
- scripts/validate-config.mjs 5.3 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 79 lines · 98 tokens per session scan A 0551fca5048f
tend-onboard is a skill published in the GitHub repository robcsaszar/tend (0 stars, last pushed 4d ago), licensed MIT. It adds 98 tokens to every session and 2,118 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
agent-desktop
Reliable computer use via native OS accessibility trees. Use when an AI agent needs to see and operate desktop applications (click buttons, fill forms, navigate menus, read UI state, toggle checkboxes, scroll, drag, type text, take screenshots, manage windows, use clipboard, manage notifications). Covers 59 command…
subagents-orchestration-guide
Guides subagent coordination through implementation workflows. Use when orchestrating multiple agents, managing workflow phases, or determining autonomous execution mode.
ai-development-guide
Applies language-agnostic and backend technical decision criteria, anti-pattern detection, debugging, and quality gates. Use when reviewing general/backend implementation choices, code smells, failures, or implementation completeness.
integration-e2e-testing
Integration and E2E test design principles, ROI calculation, test skeleton specification, and review criteria. Use when designing integration tests, E2E tests, or reviewing test quality.
recipe-diagnose
Investigate problem, verify findings, and derive solutions.
recipe-front-review
Reviews completed frontend implementation for governing-source compliance, scope economy, repository quality, and security, then applies user-approved React corrections.