What is onboard-repository?

A repository onboarding workflow that sets up standard software-development practices, checks the codebase, and creates or updates project documentation and issue-triage automation.

Use it once when adopting a repository to bootstrap its development process, generate a README when needed, run health checks, configure scheduled GitHub issue triage, and review existing issues.

It gives an existing repository a consistent starting structure and turns diagnostic findings into a prioritized backlog instead of leaving setup and maintenance work scattered.

onboard-repository — Skill for Claude Code by tomzx

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add tomzx/agents --skill onboard-repository

Clone the repo

git clone --depth 1 https://github.com/tomzx/agents

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/tomzx/agents/onboard-repository/github.svg)](https://agentmods.dev/skills/tomzx/agents/onboard-repository)

Your own site

<a href="https://agentmods.dev/skills/tomzx/agents/onboard-repository"><img src="https://agentmods.dev/badge/skills/tomzx/agents/onboard-repository/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/tomzx/agents/onboard-repository"><img src="https://agentmods.dev/badge/skills/tomzx/agents/onboard-repository.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 52 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 2,853 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector warn 7 Sept 2026

SkillSpector: 1 finding, up to medium

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

medium Agent Snooping · line 21
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00052	$0.02853
Opus 5	$0.00026	$0.01426
Sonnet 5	$0.00010	$0.00571
Haiku 4.5	$0.00005	$0.00285

Measured 6d ago against content hash cfa4b44a8043, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-09, from the pricing page.

Security

Grade A, and why

onboard-repository scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/onboard-repository/SKILL.md · 286 lines

How it starts

The opening of the file, as written. The whole thing — 286 lines — stays where its author put it; the contents beside it link to each section on GitHub.

TODAY=!date +%Y-%m-%d

Onboard Repository

Runs a one-time onboarding sequence that brings a repository up to the standard practices encoded in this skill library. The sequence bootstraps the SDLC structure, configures automated issue triaging, generates a README if needed, runs diagnostic skills, creates prioritized issues from findings, and triages any existing backlog.

Prerequisites

git repository with commit history
gh CLI authenticated with write access to the target repository
Working directory is the root of the repository (or $1 is provided)
Network access for vulnerability database lookups and GitHub API calls
Read any files present under .sdlc/context/ and apply any artifact style rules found there to produced documents
Follow skills/github-post-attribution/SKILL.md to resolve commit SHA and append attribution footers to every issue body and comment posted to GitHub

Pipeline Overview

Phase 1: SDLC Bootstrap
  /sync-sdlc                   Create or update .sdlc/ with populated context files
          |
          v
Phase 2: Automated Triage Workflow
  Create GitHub Actions        Scheduled workflow to run /triage-issues
  workflow file                on unlabeled issues
          |
          v
Phase 3: README
  /create-readme                Generate README.md if missing or minimal
          |
          v
Phase 4: Repository Health Assessment
  /audit-dependencies          CVEs, outdated, unmaintained, license issues
  /audit-security              Hardcoded secrets, injection, missing auth
  /analyze-git-churn           High-churn files needing refactor
  /find-complexity-hotspots    Cyclomatic complexity, nesting, length
  /find-type-gaps              Missing type annotations (Python/TS/JS)
  /find-coverage-gaps          Missing or insufficient test coverage
  /find-dead-code              Unused functions, classes, exports, flags
  /find-code-duplication       Copy-pasted blocks, near-duplicate logic
  /find-documentation-gaps     Undocumented public APIs, CLI, config
          |
          v
Phase 5: Create Issues from Findings
  /create-issue                One issue per high/critical finding
  Prioritize by severity       Critical findings first, then high, medium
          |
          v
Phase 6: Triage Existing Backlog
  /triage-issues               Classify and label all existing unlabeled issues

Read the full file on GitHub · 286 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

6d ago First seen · 286 lines · 52 tokens per session scan A cfa4b44a8043

Subscribe to this mod's changes

onboard-repository is a skill published in the GitHub repository tomzx/agents (6 stars, last pushed yesterday), licensed MIT. It adds 52 tokens to every session and 2,853 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

Git and workflow Project management

mcore-split-pr

Split a PR into multiple PRs to reduce the number of required CODEOWNERS reviewer groups.

NVIDIA/skills · 25 tokens

shiplog

Recap of everything shipped since the last run - cross-repo PRs, security fixes, star deltas, and X traction, synthesized into a digest article and a ready-to-post shiplog in your voice.

aeonfun/aeon · 46 tokens

llxprt-issue-workflow

Use this skill when asked to address, fix, or work on a GitHub issue in the llxprt-code repository. Covers the complete issue lifecycle - branch setup, gh CLI usage, test-first planning, subagent delegation and review loops, the full verification cycle (including the stepfun-37 smoke test), open code review (ocr), PR…

vybestack/llxprt-code · 87 tokens

onboard-repository