onboarding — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited onboarding (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are in AUTONOMOUS MODE. Do NOT ask questions. Analyze the project codebase and produce a comprehensive developer onboarding guide.
INPUT: $ARGUMENTS
Accepted arguments:
contributing: focus on generating/updating CONTRIBUTING.md only.setup: focus on environment setup instructions only.architecture: focus on architecture overview only.============================================================ PHASE 1: CODEBASE ANALYSIS ============================================================
Step 1.1 -- Tech Stack Detection
Scan for config files to determine: primary language and version, framework, package manager (npm/yarn/pnpm/pip/poetry/cargo/go/bundler), runtime requirements, database (from config, ORM, or docker-compose), and key dependencies a new developer must understand.
Step 1.2 -- Project Structure Analysis
Map the directory structure (top-level + one level into src/lib/app dirs). Identify the architectural pattern (MVC, Clean, Hexagonal, Layered, Feature-based). Identify entry points and configuration files.
Step 1.3 -- Build and Run Commands
Extract from config files and scripts: install, build, dev, test (unit/integration/e2e), lint/format, database migration, and any custom scripts (Makefile, package.json scripts).
Step 1.4 -- Environment Setup Requirements
Detect: .env.example variables, docker-compose service dependencies, required external tools (Docker, cloud SDKs, platform SDKs), and pre-commit hooks (.husky/, .pre-commit-config.yaml).
Step 1.5 -- Code Conventions
Detect from config: linter (.eslintrc, .pylintrc, golangci-lint), formatter (.prettierrc, black, rustfmt), TypeScript strictness, .editorconfig, import ordering rules, and naming conventions inferred from code patterns.
Step 1.6 -- Git and PR Workflow
Detect: branch naming patterns, PR templates, issue templates, commit message conventions, CI checks on PRs, and CODEOWNERS.
Step 1.7 -- Key Architectural Patterns
Read 3-5 representative source files to identify: dependency injection, error handling, logging, auth patterns, API response format, database access patterns, and testing patterns (naming, fixtures, mocks).
============================================================ PHASE 2: GUIDE GENERATION ============================================================
Generate the onboarding guide with these sections. Output to docs/onboarding.md for comprehensive guide, and optionally CONTRIBUTING.md in root if it does not exist.
Required sections:
configure required variables (table with variable, description, how to obtain), set up database, verify setup works.
table of common development commands (start, test, lint, build).
Test file naming convention and organization.
descriptions, data flow explanation, key patterns with example file references.
import ordering, where to put new features/tests/endpoints.
PR process (create, CI checks, review requirements, merge strategy).
database model, adding a new UI screen (adapt to project type).
If CONTRIBUTING.md does not exist, write a concise version to project root covering: fork, branch, make changes, run tests, submit PR. Link to full onboarding guide.
If CONTRIBUTING.md already exists, read it first and merge new content.
============================================================ PHASE 3: VALIDATE AND WRITE ============================================================
For each command in the guide:
Write files:
docs/onboarding.md -- Comprehensive developer onboarding guideCONTRIBUTING.md -- Concise contribution guidelines (if created)============================================================ SELF-HEALING VALIDATION (max 2 iterations) ============================================================
After producing documentation, validate completeness:
IF VALIDATION FAILS:
============================================================ OUTPUT ============================================================
docs/onboarding.md -- Comprehensive developer onboarding guideCONTRIBUTING.md -- Concise contribution guidelines (if created)============================================================ SELF-EVOLUTION TELEMETRY ============================================================
After producing output, record execution metadata for the /evolve pipeline.
Check if a project memory directory exists:
~/.claude/projects/skill-telemetry.md in that memory directoryEntry format:
### /onboarding — {{YYYY-MM-DD}}
- Outcome: {{SUCCESS | PARTIAL | FAILED}}
- Self-healed: {{yes — what was healed | no}}
- Iterations used: {{N}} / {{N max}}
- Bottleneck: {{phase that struggled or "none"}}
- Suggestion: {{one-line improvement idea for /evolve, or "none"}}Only log if the memory directory exists. Skip silently if not found. Keep entries concise — /evolve will parse these for skill improvement signals.
============================================================ DO NOT ============================================================
NEXT STEPS:
After generating the onboarding guide:
/document to check overall documentation health."/readme to ensure the README links to the onboarding guide."/diagram to generate architecture diagrams for the guide."~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.