Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add VioletCranberry/coco-search --skill cocosearch-onboardinggit clone --depth 1 https://github.com/VioletCranberry/coco-searchWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/violetcranberry/coco-search/cocosearch-onboarding)<a href="https://agentmods.dev/skills/violetcranberry/coco-search/cocosearch-onboarding"><img src="https://agentmods.dev/badge/skills/violetcranberry/coco-search/cocosearch-onboarding/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/violetcranberry/coco-search/cocosearch-onboarding"><img src="https://agentmods.dev/badge/skills/violetcranberry/coco-search/cocosearch-onboarding.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00037 | $0.01563 |
| Opus 5 | $0.00018 | $0.00781 |
| Sonnet 5 | $0.00007 | $0.00313 |
| Haiku 4.5 | $0.00004 | $0.00156 |
Grade A, and why
cocosearch-onboarding scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 160 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Codebase Onboarding Workflow
Welcome to a new codebase. I'll guide you through understanding it step-by-step, like a senior developer giving you the tour. We'll use CocoSearch's semantic search to explore the architecture, key modules, and patterns without getting lost in the details.
Pre-flight Check
Before we start exploring, let me check if we have a CocoSearch index for this codebase.
I'll run:
- Resolve index name (use the resolved name for all operations):
- Try
cocosearch.yamlforindexNamefield -- if found, use it - If no config file, call
list_indexes()and match the current project's directory name against available indexes. The MCP tools auto-derive index names from directory paths (e.g.,my-project/->my_project), so a match is likely if the repo was indexed without a config file. - If no match found, the project is genuinely not indexed -- offer to index it. Do NOT abandon CocoSearch tools just because
cocosearch.yamlis missing.
- Try
list_indexes()- Check what indexes existindex_stats(index_name="<resolved-name>")- Check index health and freshness
What to look for:
- No index found: Offer to run
index_codebase(path, index_name="<resolved-name>")to create one before we start. - Index exists but stale (>7 days): Mention the index might be outdated and ask if you want to reindex for the freshest results
- Index fresh: Great! We can start exploring immediately
Why this matters: Stale indexes might miss recent refactorings or new modules. A fresh index gives you the most accurate picture of the codebase.
Step 1: Architecture Overview (10,000ft View)
Let me get the big picture first. I'll search for entry points and project organization to understand what this codebase does and how it's structured.
I'll search for:
- Entry points:
search_code("main entry point application startup", symbol_type="function") - Project structure:
search_code("module initialization configuration setup") - Core configuration:
search_code("config settings environment variables")
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 160 lines · 37 tokens per session scan A 5b5e2bb9ed50
cocosearch-onboarding is a skill published in the GitHub repository VioletCranberry/coco-search (37 stars, last pushed today), licensed MIT. It adds 37 tokens to every session and 1,563 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
gno
Search local documents, files, notes, and knowledge bases. Index directories, search with BM25/vector/hybrid, get AI answers with citations. Use when user wants to search files, find documents, query notes, look up information in local folders, index a directory, set up document search, build a knowledge base, needs…
vera
Code search over the current repository. Before reading files to answer "where is X", "how does Y work", "find Z", or "what calls W", run vera search " " or vera references first. Use vera grep for exact strings and regex, vera structural for definitions, routes, and env reads. Do not read multiple files hoping to…
memory-capture
Capture decisions, learnings, patterns, and context as persistent memories that survive across sessions.
memory-recall
Search and surface relevant memories to inform current work with decisions, patterns, and learnings from past sessions.
subcog-integrator
Analyze and enhance AI prompts, skills, commands, hooks, and system configurations to leverage Subcog's persistent memory system effectively.
rawq
Context retrieval engine. Semantic + lexical hybrid search over codebases. Returns ranked code chunks with file paths, line ranges, scope labels, and confidence scores.