Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/ryanzhao1011/workframe/onboardnpx skills add ryanzhao1011/workframe --skill onboardgit clone --depth 1 https://github.com/ryanzhao1011/workframeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ryanzhao1011/workframe/onboard)<a href="https://agentmods.dev/skills/ryanzhao1011/workframe/onboard"><img src="https://agentmods.dev/badge/skills/ryanzhao1011/workframe/onboard.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00062 | $0.02922 |
| Opus 5 | $0.00031 | $0.01461 |
| Sonnet 5 | $0.00012 | $0.00584 |
| Haiku 4.5 | $0.00006 | $0.00292 |
Grade B, and why
onboard scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
- **写 settings.json / settings.local.json / ~/.claude/settings.json 必须**:备份 + JSON merge 保留原字段 + 失败兜底输出手动补丁 How it starts
The opening of the file, as written. The whole thing — 271 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/core:onboard 一次性可选配置引导
用途
由用户显式 /core:onboard 触发。Claude 不会自动调用(disable-model-invocation: true)。
以保守默认 + 显式 opt-in + local 优先 + 默认 skip + onboard 统一写入状态原则,向用户呈现 workframe 推荐但不强求的可选环境配置(当前仅 1 项:Claude Code Agent Teams flag),完成后写入 .claude/workframe-state/onboarded.json 标记。
完成此 skill 后,SessionStart hook 不再打印 onboarding 提示。
设计原则(不可妥协)
- plugin 不依赖任何被引导的可选 flag——所有可选项默认 skip 后 plugin 仍正常工作
- 所有写入必须用户当面授权——SKILL.md 不允许"为了流程顺滑"擅自写任何文件
- 写 settings.json / settings.local.json / ~/.claude/settings.json 必须:备份 + JSON merge 保留原字段 + 失败兜底输出手动补丁
- 写 .gitignore 必须先询问——动 git 行为相关文件需用户当面同意
- skip 也是有效决策——同样写 onboarded.json 让 hook 静默
输入
参数(自由文本):
- 无参数 → 标准 onboarding 流程
--upgrade→ 已 onboarded 但 onboarding version 落后时的增量补齐(预留接口,落地版本待定)
前置检查
-
是否已 onboarded:Read
.claude/workframe-state/onboarded.json- 文件存在且
version== 当前 SKILL.md 中ONBOARDING_VERSION常量 → 用 AskUserQuestion 问"已完成 onboarding,是否重走全流程",拒绝则结束并打印当前 onboarded.json 摘要 - 文件不存在 → 进入正式流程
version落后 → 仅处理新增项(不动已有 status 为 enabled_* 的旧项)
- 文件存在且
-
找到 recommended-env.json:
- 优先:Read
.claude/workframe-state/plugin-root.txt取插件根(SessionStart hook 每会话刷新)→ 拼接<插件根>/recommended-env.json - 回退:
Glob **/plugins/core/recommended-env.json(plugin-root.txt 缺失的开发场景) - 找不到 → 终止 skill,输出"plugin 安装可能不完整:core 插件根下缺 recommended-env.json"
- 优先:Read
-
Read recommended-env.json,按
recommended_env_vars数组逐项处理(Step 1-7)。
ONBOARDING_VERSION 常量:当前
0.2.1。每次新增 recommended_env_var 项时 bump,配合--upgrade增量逻辑。
单项 env 处理流程
对 recommended_env_vars 中每一项执行 Step 1-7。本 SKILL.md 的所有"该项"指代当前正在处理的 env 项。
Step 1 — 版本检查
claude --version
解析输出形如 2.1.32 (Claude Code) 的版本号。对比该项 min_cli_version:
- 当前 < min_cli_version → 打印"当前 Claude Code 版本 X.Y.Z < {min_cli_version}({env_name} 要求版本),跳过此项",记录 status=
skipped_version,跳到下一项 - 解析失败 → 打印 warning,按"无法判断版本"处理,记录 status=
skipped_version_check_failed,跳到下一项
Step 2 — 已配置检查
检查环境变量是否已被用户在系统层面设置:
PowerShell:
[Environment]::GetEnvironmentVariable('{env_name}','User')
[Environment]::GetEnvironmentVariable('{env_name}','Machine')
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 271 lines · 62 tokens per session scan B ec0aff452f83
onboard is a skill published in the GitHub repository ryanzhao1011/workframe (4 stars, last pushed 17d ago), licensed MIT. It adds 62 tokens to every session and 2,922 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
html-prototype
Generate HTML prototypes (single-file, browser-openable) for product mockups using the user's design system — fonts, color scales, radii, shadows, components, all driven by a tokens.css file. Use when the user asks to make a 原型 / mockup / HTML 设计图 / 设计图给前端 for a PRD module, OR redesign an existing prototype. Output…
feature-acceptance
研发提测后接管浏览器,对照 PRD(必给)+ HTML 原型(自动找)逐项验收线上实现,产出差异清单(实现 / 部分实现 / 未实现 / 与原型或 PRD 不一致)+ 截图证据 + 阻塞问题排序。Use whenever PM 说「验收 XX」「跑一下 XX」「研发提测了」「对一下需求和线上」「点一下 XX 看符不符合需求」「看哪些实现了哪些没做」「上线前 check」「灰度验收」「acceptance」「QA check」,or 给出 PRD 路径 + 线上 URL 让 Claude 走流程。也适用于 PM 想自己点某功能、判断和需求差异时陪她一起跑。区别于 prd skill:本 skill 验证线上现状,不修改 PRD…
prd
Write, rewrite, polish, restructure, or review product requirements documents (PRDs). Use whenever a task touches a 需求文档 / PRD —— 新写、重构、统一口径、补页面结构 / 字段 / 规则 / 边界 / 异常处理、加指标口径定义、按数据看板或某类骨架组织章节,或把讨论 / 会议记录整理成正式产品文档。Trigger even when the user does NOT say "写需求" —— e.g. "把这个加到…
ui-walkthrough
把一份 UI 设计 HTML 和研发上线的页面,同视口、同状态截图比对 + 读 computed style 实锤,产出 UI 还原度差异清单(结构 / 组件 / 颜色 / 字体 / 圆角 / 图标 / 间距 七维,每条标明设计值 vs 线上值)。Use whenever PM 说「UI 走查」「走查一下 UI」「对一下 UI」「UI 还原度」「还原度走查」「线上跟设计稿对一下」「前端还原得对不对」「页面跟这份 HTML 对一下」「UI 验收」「设计还原走查」,或给出 设计 HTML 路径 + 线上 URL 让 Claude 比视觉差异。区别于 feature-acceptance skill:那个验业务逻辑 / 字段 / 操作…
daily-research
Daily research briefing. When the user says "今天的调研""跑一份调研简报""每日调研""今日行业动态""扫一下最近有什么新东西""补一下今天的简报",或在会话里要求生成 / 补一份当日情报简报时,触发本 skill。它在当前会话里实时联网调研用户配置的领域(默认是 AI 应用层 / 框架 / 论文 / 模型 / 研究员与厂商落地动态),产出一份中文简报写入 /YYYY-MM-DD.md。即使用户没说"用 skill"、只说"今天调研呢""帮我看下今天有什么进展"也要触发。本 skill 只生成简报,不自动归档。.
competitor-research
建/补 竞品与 AI 调研文档时遵循。覆盖 AI 应用 / 行业产品现状(竞品库)、Agent 模块汇总与框架深挖(研究库)。规定按菜单梳理全部功能、无账号用帮助中心反推菜单、功能截图只用真实 UI 图、标题与排版口径、主题分流与增量。Use when 写竞品现状 / AI 应用产品文档 / 模块汇总 / 框架对比 / 调研沉淀。.