Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Onboard Repository · hoangnb24 | DecimalAI

Agent Toolingby hoangnb24

Onboard Repository

Inspect an unfamiliar or brownfield repository, trace one real operational path, and propose evidence-backed improvements that help future agents work independently.

Maintained

Safety

3/3 safety checks passed

Code scan
Intent
Content

What it changes

7 of 22 test cases passed with the skill.

Model 8/17/2026v2 · latest is v37 comparable

Lift withheld: 7 comparable cases; this report requires 8.

This benchmark measured an earlier version of the skill.

A newer attempt on gemini-3.8-flash on 10/18/2026 did not produce a publishable comparison (graded differently). The snapshot above is the previously measured run.

Track record

Agent runs: 0; All time
Forks: 1

Use this skill

Your agent runs on

Adds every file the skill has, pinned so you can update it. No account needed.

pip install "decimalai>=0.15"
decimalai skills add hoangnb24-onboard-repository
claude --plugin-dir "$(git rev-parse --show-toplevel 2>/dev/null || pwd)/.agents"

The same install from Python, for a notebook or a setup script.

Install

pip install "decimalai>=0.15"

Add the skill

from decimalai import skillpkg

# Writes .agents/skills and .decimal/skills.toml. Safe to run twice.
result = skillpkg.add("hoangnb24-onboard-repository")
if result.exit_code:
    raise SystemExit(result.problems)

print("Added. Start Claude Code with the command below.")

Start Claude Code with it

claude --plugin-dir "$(git rev-parse --show-toplevel 2>/dev/null || pwd)/.agents"

Type these in a Claude Code session. No account or API key. It writes the skill and any files it bundles, and asks first when its safety rating isn't Passed.

Add the DecimalAI plugin, once

/plugin marketplace add decimal-labs/decimalai-claude-plugins
/plugin install decimalai@decimalai

Install this skill

/decimalai:install hoangnb24-onboard-repository

The plugin needs python3 and curl on your machine.

No Python or account. Claude Code picks it up in its next session.

Save it into your project

curl -fsSL --create-dirs -o .claude/skills/hoangnb24-onboard-repository/SKILL.md https://app.decimal.ai/s/hoangnb24-onboard-repository/SKILL.md

Copy SKILL.md

Save it in your project, as

.claude/skills/hoangnb24-onboard-repository/SKILL.md

This gets SKILL.md only. The skill's 4 other files are not included.

Other ways to add it

Claude Code docs

agent_config() hands your agent the skill. With no DecimalAI key it reads your project's files and sends nothing. Needs SDK 0.27 or newer.

Install

pip install "decimalai[claude-agent-sdk]"
decimalai skills add hoangnb24-onboard-repository

Add it to your agent

import asyncio

from claude_agent_sdk import ClaudeAgentOptions
from decimalai.claude_agent_sdk import agent_config

# With no DECIMAL_API_KEY this reads the skills your project lists, from disk.
support = agent_config("support", fallback="You are a helpful agent.")

async def main():
    question = "Hello!"
    async with support.run(question) as run:  # one user message, one run
        async for message in run.query(options=ClaudeAgentOptions(max_turns=6)):
            print(message)

# In a notebook or async code: await main()
asyncio.run(main())

Prefer its own loader? ClaudeAgentOptions(plugins=[skills_plugin()], skills="all") reads the same folder. Use one or the other: a skill delivered both ways reaches the prompt twice.

The same install from Python, for a notebook or a setup script. agent_config() hands your agent the skill. With no DecimalAI key it reads your project's files and sends nothing. Needs SDK 0.27 or newer.

Install

pip install "decimalai[claude-agent-sdk]"

Add it to your agent

from decimalai import skillpkg

# Writes .agents/skills and .decimal/skills.toml. Safe to run twice.
result = skillpkg.add("hoangnb24-onboard-repository")
if result.exit_code:
    raise SystemExit(result.problems)

import asyncio

from claude_agent_sdk import ClaudeAgentOptions
from decimalai.claude_agent_sdk import agent_config

# With no DECIMAL_API_KEY this reads the skills your project lists, from disk.
support = agent_config("support", fallback="You are a helpful agent.")

async def main():
    question = "Hello!"
    async with support.run(question) as run:  # one user message, one run
        async for message in run.query(options=ClaudeAgentOptions(max_turns=6)):
            print(message)

# In a notebook or async code: await main()
asyncio.run(main())

Prefer its own loader? ClaudeAgentOptions(plugins=[skills_plugin()], skills="all") reads the same folder. Use one or the other: a skill delivered both ways reaches the prompt twice.

No DecimalAI package. The whole skill goes in every prompt, and nothing pins or updates it.

Copy SKILL.md

Save it in your project, as

.agents/skills/hoangnb24-onboard-repository/SKILL.md

Give it to your agent

import asyncio
from pathlib import Path
from claude_agent_sdk import ClaudeAgentOptions, query

skill = Path(".agents/skills/hoangnb24-onboard-repository/SKILL.md").read_text()
options = ClaudeAgentOptions(system_prompt=f"You are a helpful agent.\n\n{skill}", max_turns=6)

async def main():
    async for message in query(prompt="Hello!", options=options):
        print(message)

# In a notebook or async code: await main()
asyncio.run(main())

This gets SKILL.md only. The skill's 4 other files are not included.

Other ways to add it

Claude Agent SDK docs

agent_config() hands your agent the skill. With no DecimalAI key it reads your project's files and sends nothing. Needs SDK 0.27 or newer.

Install

pip install "decimalai[openai-agents]"
decimalai skills add hoangnb24-onboard-repository

Add it to your agent

from agents import Agent, Runner
from decimalai.openai_agents import agent_config

# With no DECIMAL_API_KEY this reads the skills your project lists, from disk.
support = agent_config("support", fallback="You are a helpful agent.")

agent = Agent(
    name=support.name,
    instructions=support.instructions,  # your prompt, then the skill list
    tools=[*support.tools],             # your tools, then load_skill
)
# In a notebook or async code: result = await Runner.run(agent, "Hello!")
result = Runner.run_sync(agent, "Hello!")

Using SandboxAgent? capabilities=[Shell(), decimalai.openai_agents.sandbox_skills()] points its own loader at the same folder.

Install

pip install "decimalai[openai-agents]"

Add it to your agent

from decimalai import skillpkg

# Writes .agents/skills and .decimal/skills.toml. Safe to run twice.
result = skillpkg.add("hoangnb24-onboard-repository")
if result.exit_code:
    raise SystemExit(result.problems)

from agents import Agent, Runner
from decimalai.openai_agents import agent_config

# With no DECIMAL_API_KEY this reads the skills your project lists, from disk.
support = agent_config("support", fallback="You are a helpful agent.")

agent = Agent(
    name=support.name,
    instructions=support.instructions,  # your prompt, then the skill list
    tools=[*support.tools],             # your tools, then load_skill
)
# In a notebook or async code: result = await Runner.run(agent, "Hello!")
result = Runner.run_sync(agent, "Hello!")

Using SandboxAgent? capabilities=[Shell(), decimalai.openai_agents.sandbox_skills()] points its own loader at the same folder.

No DecimalAI package. The whole skill goes in every prompt, and nothing pins or updates it.

Copy SKILL.md

Save it in your project, as

.agents/skills/hoangnb24-onboard-repository/SKILL.md

Give it to your agent

from pathlib import Path
from agents import Agent, Runner

skill = Path(".agents/skills/hoangnb24-onboard-repository/SKILL.md").read_text()
agent = Agent(name="support", instructions=f"You are a helpful agent.\n\n{skill}")
# In a notebook or async code: result = await Runner.run(agent, "Hello!")
result = Runner.run_sync(agent, "Hello!")

This gets SKILL.md only. The skill's 4 other files are not included.

Other ways to add it

OpenAI Agents docs

agent_config() hands your agent the skill. With no DecimalAI key it reads your project's files and sends nothing. Needs SDK 0.27 or newer.

Install

pip install "decimalai[openai]"
decimalai skills add hoangnb24-onboard-repository

Add it to your agent

import json

from openai import OpenAI
from decimalai.openai import agent_config

client = OpenAI()
# With no DECIMAL_API_KEY this reads the skills your project lists, from disk.
support = agent_config("support", fallback="You are a helpful agent.")


def lookup_order(order_id: str) -> str:
    return f"Order {order_id} shipped yesterday."


# Your tools, as Chat Completions takes them, and what answers each.
TOOLS = [{"type": "function", "function": {
    "name": "lookup_order",
    "description": "Look up the status of an order.",
    "parameters": {"type": "object", "properties": {"order_id": {"type": "string"}},
                   "required": ["order_id"]},
}}]
FUNCTIONS = {"lookup_order": lookup_order}

question = "Where is order A1001?"
with support.run(question) as run:  # one user message, one run
    # run.system is your prompt, then the skill list.
    messages = [{"role": "system", "content": run.system}, run.message]
    while True:
        reply = client.chat.completions.create(
            model="gpt-5.4-mini",
            messages=messages,
            tools=[*TOOLS, *run.tools],  # your tools, then load_skill
        ).choices[0].message
        messages.append(reply)
        if not reply.tool_calls:
            break
        for call in reply.tool_calls:
            # load_skill is answered by the run; your own tools by FUNCTIONS.
            function = FUNCTIONS.get(call.function.name)
            messages.append(run.tool_result(call) or {
                "role": "tool", "tool_call_id": call.id,
                "content": function(**json.loads(call.function.arguments)) if function
                else f"There is no tool named {call.function.name!r}.",
            })
print(reply.content)

# The Responses API takes run.response_tools instead of run.tools.

Install

pip install "decimalai[openai]"

Add it to your agent

from decimalai import skillpkg

# Writes .agents/skills and .decimal/skills.toml. Safe to run twice.
result = skillpkg.add("hoangnb24-onboard-repository")
if result.exit_code:
    raise SystemExit(result.problems)

import json

from openai import OpenAI
from decimalai.openai import agent_config

client = OpenAI()
# With no DECIMAL_API_KEY this reads the skills your project lists, from disk.
support = agent_config("support", fallback="You are a helpful agent.")


def lookup_order(order_id: str) -> str:
    return f"Order {order_id} shipped yesterday."


# Your tools, as Chat Completions takes them, and what answers each.
TOOLS = [{"type": "function", "function": {
    "name": "lookup_order",
    "description": "Look up the status of an order.",
    "parameters": {"type": "object", "properties": {"order_id": {"type": "string"}},
                   "required": ["order_id"]},
}}]
FUNCTIONS = {"lookup_order": lookup_order}

question = "Where is order A1001?"
with support.run(question) as run:  # one user message, one run
    # run.system is your prompt, then the skill list.
    messages = [{"role": "system", "content": run.system}, run.message]
    while True:
        reply = client.chat.completions.create(
            model="gpt-5.4-mini",
            messages=messages,
            tools=[*TOOLS, *run.tools],  # your tools, then load_skill
        ).choices[0].message
        messages.append(reply)
        if not reply.tool_calls:
            break
        for call in reply.tool_calls:
            # load_skill is answered by the run; your own tools by FUNCTIONS.
            function = FUNCTIONS.get(call.function.name)
            messages.append(run.tool_result(call) or {
                "role": "tool", "tool_call_id": call.id,
                "content": function(**json.loads(call.function.arguments)) if function
                else f"There is no tool named {call.function.name!r}.",
            })
print(reply.content)

# The Responses API takes run.response_tools instead of run.tools.

No DecimalAI package. The whole skill goes in every prompt, and nothing pins or updates it.

Copy SKILL.md

Save it in your project, as

.agents/skills/hoangnb24-onboard-repository/SKILL.md

Give it to your agent

from pathlib import Path
from openai import OpenAI

client = OpenAI()
skill = Path(".agents/skills/hoangnb24-onboard-repository/SKILL.md").read_text()
reply = client.chat.completions.create(
    model="gpt-5.4-mini",
    messages=[
        {"role": "system", "content": f"You are a helpful agent.\n\n{skill}"},
        {"role": "user", "content": "Hello!"},
    ],
).choices[0].message

This gets SKILL.md only. The skill's 4 other files are not included.

Other ways to add it

OpenAI SDK docs

agent_config() hands your agent the skill. With no DecimalAI key it reads your project's files and sends nothing. Needs SDK 0.27 or newer.

Install

pip install "decimalai[anthropic]"
decimalai skills add hoangnb24-onboard-repository

Add it to your agent

import anthropic
from decimalai.anthropic import agent_config

client = anthropic.Anthropic()
# With no DECIMAL_API_KEY this reads the skills your project lists, from disk.
support = agent_config("support", fallback="You are a helpful agent.")

question = "Hello!"
with support.run(question) as run:  # one user message, one run
    answer = client.beta.messages.tool_runner(
        model="claude-haiku-5-5",
        max_tokens=4096,
        system=run.system,     # your prompt, then the skill list
        tools=[*run.tools],    # your tools, then load_skill
        messages=[{"role": "user", "content": question}],
    ).until_done()

Install

pip install "decimalai[anthropic]"

Add it to your agent

from decimalai import skillpkg

# Writes .agents/skills and .decimal/skills.toml. Safe to run twice.
result = skillpkg.add("hoangnb24-onboard-repository")
if result.exit_code:
    raise SystemExit(result.problems)

import anthropic
from decimalai.anthropic import agent_config

client = anthropic.Anthropic()
# With no DECIMAL_API_KEY this reads the skills your project lists, from disk.
support = agent_config("support", fallback="You are a helpful agent.")

question = "Hello!"
with support.run(question) as run:  # one user message, one run
    answer = client.beta.messages.tool_runner(
        model="claude-haiku-5-5",
        max_tokens=4096,
        system=run.system,     # your prompt, then the skill list
        tools=[*run.tools],    # your tools, then load_skill
        messages=[{"role": "user", "content": question}],
    ).until_done()

No DecimalAI package. The whole skill goes in every prompt, and nothing pins or updates it.

Copy SKILL.md

Save it in your project, as

.agents/skills/hoangnb24-onboard-repository/SKILL.md

Give it to your agent

from pathlib import Path
import anthropic

client = anthropic.Anthropic()
skill = Path(".agents/skills/hoangnb24-onboard-repository/SKILL.md").read_text()
reply = client.messages.create(
    model="claude-haiku-5-5",
    max_tokens=4096,
    system=f"You are a helpful agent.\n\n{skill}",
    messages=[{"role": "user", "content": "Hello!"}],
)

This gets SKILL.md only. The skill's 4 other files are not included.

Other ways to add it

Anthropic docs

agent_config() hands your agent the skill. With no DecimalAI key it reads your project's files and sends nothing. Needs SDK 0.27 or newer.

Install

pip install "decimalai[google-genai]"
decimalai skills add hoangnb24-onboard-repository

Add it to your agent

from google import genai
from google.genai import types
from decimalai.google_genai import agent_config

client = genai.Client()
# With no DECIMAL_API_KEY this reads the skills your project lists, from disk.
support = agent_config("support", fallback="You are a helpful agent.")


def lookup_order(order_id: str) -> str:
    return f"Order {order_id} shipped yesterday."


# Your functions, as declarations for the model, and what answers each.
TOOLS = [{"function_declarations": [{
    "name": "lookup_order",
    "description": "Look up the status of an order.",
    "parameters_json_schema": {"type": "object", "properties": {"order_id": {"type": "string"}},
                               "required": ["order_id"]},
}]}]
FUNCTIONS = {"lookup_order": lookup_order}

question = "Where is order A1001?"
with support.run(question) as run:  # one user message, one run
    config = types.GenerateContentConfig(
        system_instruction=run.system,     # your prompt, then the skill list
        tools=[*TOOLS, *run.tool_params],  # your functions, then load_skill
    )
    contents = [{"role": "user", "parts": [{"text": run.message}]}]
    while True:
        response = client.models.generate_content(
            model="gemini-3.5-flash", contents=contents, config=config,
        )
        if not response.function_calls:
            break
        contents.append(response.candidates[0].content)
        parts = []
        for call in response.function_calls:
            # load_skill is answered by the run; your own functions by FUNCTIONS.
            # A loop of your own rather than automatic function calling, which
            # raises KeyError when the model asks for a function you did not pass.
            function = FUNCTIONS.get(call.name)
            parts.append(run.tool_result(call) or {"function_response": {
                "name": call.name, "id": call.id,
                "response": {"result": function(**(call.args or {})) if function
                             else f"There is no function named {call.name!r}."},
            }})
        contents.append({"role": "user", "parts": parts})
print(response.text)

Install

pip install "decimalai[google-genai]"

Add it to your agent

from decimalai import skillpkg

# Writes .agents/skills and .decimal/skills.toml. Safe to run twice.
result = skillpkg.add("hoangnb24-onboard-repository")
if result.exit_code:
    raise SystemExit(result.problems)

from google import genai
from google.genai import types
from decimalai.google_genai import agent_config

client = genai.Client()
# With no DECIMAL_API_KEY this reads the skills your project lists, from disk.
support = agent_config("support", fallback="You are a helpful agent.")


def lookup_order(order_id: str) -> str:
    return f"Order {order_id} shipped yesterday."


# Your functions, as declarations for the model, and what answers each.
TOOLS = [{"function_declarations": [{
    "name": "lookup_order",
    "description": "Look up the status of an order.",
    "parameters_json_schema": {"type": "object", "properties": {"order_id": {"type": "string"}},
                               "required": ["order_id"]},
}]}]
FUNCTIONS = {"lookup_order": lookup_order}

question = "Where is order A1001?"
with support.run(question) as run:  # one user message, one run
    config = types.GenerateContentConfig(
        system_instruction=run.system,     # your prompt, then the skill list
        tools=[*TOOLS, *run.tool_params],  # your functions, then load_skill
    )
    contents = [{"role": "user", "parts": [{"text": run.message}]}]
    while True:
        response = client.models.generate_content(
            model="gemini-3.5-flash", contents=contents, config=config,
        )
        if not response.function_calls:
            break
        contents.append(response.candidates[0].content)
        parts = []
        for call in response.function_calls:
            # load_skill is answered by the run; your own functions by FUNCTIONS.
            # A loop of your own rather than automatic function calling, which
            # raises KeyError when the model asks for a function you did not pass.
            function = FUNCTIONS.get(call.name)
            parts.append(run.tool_result(call) or {"function_response": {
                "name": call.name, "id": call.id,
                "response": {"result": function(**(call.args or {})) if function
                             else f"There is no function named {call.name!r}."},
            }})
        contents.append({"role": "user", "parts": parts})
print(response.text)

No DecimalAI package. The whole skill goes in every prompt, and nothing pins or updates it.

Copy SKILL.md

Save it in your project, as

.agents/skills/hoangnb24-onboard-repository/SKILL.md

Give it to your agent

from pathlib import Path
from google import genai
from google.genai import types

client = genai.Client()
skill = Path(".agents/skills/hoangnb24-onboard-repository/SKILL.md").read_text()
response = client.models.generate_content(
    model="gemini-3.5-flash",
    contents="Hello!",
    config=types.GenerateContentConfig(system_instruction=f"You are a helpful agent.\n\n{skill}"),
)

This gets SKILL.md only. The skill's 4 other files are not included.

Other ways to add it

Gemini API docs

agent_config() hands your agent the skill. With no DecimalAI key it reads your project's files and sends nothing. Needs SDK 0.27 or newer.

Install

pip install "decimalai[langchain]" langchain-openai
decimalai skills add hoangnb24-onboard-repository

Add it to your agent

from langchain.agents import create_agent
from decimalai.langchain import agent_config

# With no DECIMAL_API_KEY this reads the skills your project lists, from disk.
support = agent_config("support", fallback="You are a helpful agent.")

agent = create_agent(
    "openai:gpt-5.4-mini",
    tools=[],                         # your tools; the middleware adds load_skill
    middleware=[support.middleware],  # your prompt, the skill list and load_skill
)
result = agent.invoke({"messages": [{"role": "user", "content": "Hello!"}]})

Install

pip install "decimalai[langchain]" langchain-openai

Add it to your agent

from decimalai import skillpkg

# Writes .agents/skills and .decimal/skills.toml. Safe to run twice.
result = skillpkg.add("hoangnb24-onboard-repository")
if result.exit_code:
    raise SystemExit(result.problems)

from langchain.agents import create_agent
from decimalai.langchain import agent_config

# With no DECIMAL_API_KEY this reads the skills your project lists, from disk.
support = agent_config("support", fallback="You are a helpful agent.")

agent = create_agent(
    "openai:gpt-5.4-mini",
    tools=[],                         # your tools; the middleware adds load_skill
    middleware=[support.middleware],  # your prompt, the skill list and load_skill
)
result = agent.invoke({"messages": [{"role": "user", "content": "Hello!"}]})

No DecimalAI package. The whole skill goes in every prompt, and nothing pins or updates it.

Copy SKILL.md

Save it in your project, as

.agents/skills/hoangnb24-onboard-repository/SKILL.md

Give it to your agent

from pathlib import Path
from langchain.agents import create_agent

skill = Path(".agents/skills/hoangnb24-onboard-repository/SKILL.md").read_text()
agent = create_agent("openai:gpt-5.4-mini", tools=[], system_prompt=f"You are a helpful agent.\n\n{skill}")
result = agent.invoke({"messages": [{"role": "user", "content": "Hello!"}]})

This gets SKILL.md only. The skill's 4 other files are not included.

Other ways to add it

LangChain docs

CrewAI's own skill loader reads the installed folder. No DecimalAI account needed.

Install

pip install "decimalai>=0.16" "crewai>=1.15.27"
decimalai skills add hoangnb24-onboard-repository

Add it to your agent

import decimalai.crewai
from crewai import Agent, Crew, Task

agent = Agent(
    role="Support", goal="Help the customer", backstory="A support agent.",
    llm=llm,                               # your own CrewAI LLM
    skills=decimalai.crewai.skills(),      # the installed folder
    tools=decimalai.crewai.skill_tools(),  # reads a skill's files, runs its scripts
)
task = Task(description="Hello!", expected_output="an answer", agent=agent)
Crew(agents=[agent], tasks=[task]).kickoff()

The same install from Python, for a notebook or a setup script. CrewAI's own skill loader reads the installed folder. No DecimalAI account needed.

Install

pip install "decimalai>=0.16" "crewai>=1.15.27"

Add it to your agent

from decimalai import skillpkg

# Writes .agents/skills and .decimal/skills.toml. Safe to run twice.
result = skillpkg.add("hoangnb24-onboard-repository")
if result.exit_code:
    raise SystemExit(result.problems)

import decimalai.crewai
from crewai import Agent, Crew, Task

agent = Agent(
    role="Support", goal="Help the customer", backstory="A support agent.",
    llm=llm,                               # your own CrewAI LLM
    skills=decimalai.crewai.skills(),      # the installed folder
    tools=decimalai.crewai.skill_tools(),  # reads a skill's files, runs its scripts
)
task = Task(description="Hello!", expected_output="an answer", agent=agent)
Crew(agents=[agent], tasks=[task]).kickoff()

No DecimalAI package. CrewAI's own loader reads the folder, and nothing pins or updates it.

Copy SKILL.md

Save it in your project, as

.agents/skills/hoangnb24-onboard-repository/SKILL.md

Give it to your agent

from pathlib import Path
from crewai import Agent, Crew, Task

agent = Agent(
    role="Support", goal="Help the customer", backstory="A support agent.",
    llm=llm,                         # your own CrewAI LLM
    skills=[Path(".agents/skills")],
)
task = Task(description="Hello!", expected_output="an answer", agent=agent)
Crew(agents=[agent], tasks=[task]).kickoff()

This gets SKILL.md only. The skill's 4 other files are not included.

Other ways to add it

CrewAI docs

agent_config() hands your agent the skill. With no DecimalAI key it reads your project's files and sends nothing. Needs SDK 0.27 or newer.

Install

pip install "decimalai[adk]"
decimalai skills add hoangnb24-onboard-repository

Add it to your agent

from decimalai.adk import DecimalAIPlugin, agent_config
from google.adk.agents import LlmAgent
from google.adk.apps import App

# With no DECIMAL_API_KEY this reads the skills your project lists, from disk.
support = agent_config("support", fallback="You are a helpful agent.")

agent = LlmAgent(
    name="support",          # ADK needs a Python identifier
    model="gemini-3.5-flash",
    instruction=support.instruction,  # your prompt, then the skill list
    tools=[*support.tools],           # your tools, then load_skill
)
# DecimalAIPlugin makes each invocation of runners built from this App one trace.
app = App(name="support", root_agent=agent, plugins=[DecimalAIPlugin()])

Prefer ADK's own loader? SkillToolset(skills=decimalai.adk.skills(), ...) reads the same folder. Use one or the other: a skill delivered both ways reaches the prompt twice.

Install

pip install "decimalai[adk]"

Add it to your agent

from decimalai import skillpkg

# Writes .agents/skills and .decimal/skills.toml. Safe to run twice.
result = skillpkg.add("hoangnb24-onboard-repository")
if result.exit_code:
    raise SystemExit(result.problems)

from decimalai.adk import DecimalAIPlugin, agent_config
from google.adk.agents import LlmAgent
from google.adk.apps import App

# With no DECIMAL_API_KEY this reads the skills your project lists, from disk.
support = agent_config("support", fallback="You are a helpful agent.")

agent = LlmAgent(
    name="support",          # ADK needs a Python identifier
    model="gemini-3.5-flash",
    instruction=support.instruction,  # your prompt, then the skill list
    tools=[*support.tools],           # your tools, then load_skill
)
# DecimalAIPlugin makes each invocation of runners built from this App one trace.
app = App(name="support", root_agent=agent, plugins=[DecimalAIPlugin()])

Prefer ADK's own loader? SkillToolset(skills=decimalai.adk.skills(), ...) reads the same folder. Use one or the other: a skill delivered both ways reaches the prompt twice.

No DecimalAI package. The whole skill goes in every prompt, and nothing pins or updates it.

Copy SKILL.md

Save it in your project, as

.agents/skills/hoangnb24-onboard-repository/SKILL.md

Give it to your agent

from pathlib import Path
from google.adk.agents import LlmAgent

skill = Path(".agents/skills/hoangnb24-onboard-repository/SKILL.md").read_text()
agent = LlmAgent(
    name="support",
    model="gemini-3.5-flash",
    instruction=lambda context: f"You are a helpful agent.\n\n{skill}",
)

This gets SKILL.md only. The skill's 4 other files are not included.

Other ways to add it

Google ADK docs

agent_config() hands your agent the skill. With no DecimalAI key it reads your project's files and sends nothing. Needs SDK 0.27 or newer.

Install

pip install "decimalai[pydantic-ai]"
decimalai skills add hoangnb24-onboard-repository

Add it to your agent

from pydantic_ai import Agent
from decimalai.pydantic_ai import agent_config

# With no DECIMAL_API_KEY this reads the skills your project lists, from disk.
support = agent_config("support", fallback="You are a helpful agent.")

agent = Agent(
    "openai:gpt-4o-mini",
    name=support.name,
    tools=[],                 # your tools; the capability adds load_skill
    capabilities=[support],   # your prompt, the skill list and load_skill
)
# In a notebook or async code: result = await agent.run("Hello!")
result = agent.run_sync("Hello!")

On the Pydantic AI harness, decimalai.pydantic_ai_harness.skills(project) uses its own loader instead.

Install

pip install "decimalai[pydantic-ai]"

Add it to your agent

from decimalai import skillpkg

# Writes .agents/skills and .decimal/skills.toml. Safe to run twice.
result = skillpkg.add("hoangnb24-onboard-repository")
if result.exit_code:
    raise SystemExit(result.problems)

from pydantic_ai import Agent
from decimalai.pydantic_ai import agent_config

# With no DECIMAL_API_KEY this reads the skills your project lists, from disk.
support = agent_config("support", fallback="You are a helpful agent.")

agent = Agent(
    "openai:gpt-4o-mini",
    name=support.name,
    tools=[],                 # your tools; the capability adds load_skill
    capabilities=[support],   # your prompt, the skill list and load_skill
)
# In a notebook or async code: result = await agent.run("Hello!")
result = agent.run_sync("Hello!")

On the Pydantic AI harness, decimalai.pydantic_ai_harness.skills(project) uses its own loader instead.

No DecimalAI package. The whole skill goes in every prompt, and nothing pins or updates it.

Copy SKILL.md

Save it in your project, as

.agents/skills/hoangnb24-onboard-repository/SKILL.md

Give it to your agent

from pathlib import Path
from pydantic_ai import Agent

skill = Path(".agents/skills/hoangnb24-onboard-repository/SKILL.md").read_text()
agent = Agent("openai:gpt-4o-mini", instructions=f"You are a helpful agent.\n\n{skill}")
# In a notebook or async code: result = await agent.run("Hello!")
result = agent.run_sync("Hello!")

This gets SKILL.md only. The skill's 4 other files are not included.

Other ways to add it

Pydantic AI docs

Deep Agents' own skill loader reads the installed folder. No DecimalAI account needed.

Install

pip install "decimalai>=0.16" deepagents
decimalai skills add hoangnb24-onboard-repository

Add it to your agent

import decimalai.deepagents
from deepagents import create_deep_agent

agent = create_deep_agent(model=model, **decimalai.deepagents.skills())
agent.invoke({"messages": [{"role": "user", "content": "Hello!"}]})

The default backend reads files but has no shell. To run a skill's scripts, pass skills(backend=LocalShellBackend(...)).

The same install from Python, for a notebook or a setup script. Deep Agents' own skill loader reads the installed folder. No DecimalAI account needed.

Install

pip install "decimalai>=0.16" deepagents

Add it to your agent

from decimalai import skillpkg

# Writes .agents/skills and .decimal/skills.toml. Safe to run twice.
result = skillpkg.add("hoangnb24-onboard-repository")
if result.exit_code:
    raise SystemExit(result.problems)

import decimalai.deepagents
from deepagents import create_deep_agent

agent = create_deep_agent(model=model, **decimalai.deepagents.skills())
agent.invoke({"messages": [{"role": "user", "content": "Hello!"}]})

The default backend reads files but has no shell. To run a skill's scripts, pass skills(backend=LocalShellBackend(...)).

No DecimalAI package. The whole skill goes in every prompt, and nothing pins or updates it.

Copy SKILL.md

Save it in your project, as

.agents/skills/hoangnb24-onboard-repository/SKILL.md

Give it to your agent

from pathlib import Path
from deepagents import create_deep_agent

skill = Path(".agents/skills/hoangnb24-onboard-repository/SKILL.md").read_text()
agent = create_deep_agent(model=model, system_prompt=f"You are a helpful agent.\n\n{skill}")
agent.invoke({"messages": [{"role": "user", "content": "Hello!"}]})

This gets SKILL.md only. The skill's 4 other files are not included.

Other ways to add it

Deep Agents docs

Its own skill loader reads the installed folder. No DecimalAI account needed.

Install

pip install "decimalai>=0.16" agent-framework
decimalai skills add hoangnb24-onboard-repository

Add it to your agent

import asyncio

from agent_framework import Agent
from decimalai.agent_framework import skills

agent = Agent(client=client, instructions="You are a helpful agent.", context_providers=[skills()])
asyncio.run(agent.run("Hello!"))

It caches skills by default, so restart the process after decimalai skills update.

The same install from Python, for a notebook or a setup script. Its own skill loader reads the installed folder. No DecimalAI account needed.

Install

pip install "decimalai>=0.16" agent-framework

Add it to your agent

from decimalai import skillpkg

# Writes .agents/skills and .decimal/skills.toml. Safe to run twice.
result = skillpkg.add("hoangnb24-onboard-repository")
if result.exit_code:
    raise SystemExit(result.problems)

import asyncio

from agent_framework import Agent
from decimalai.agent_framework import skills

agent = Agent(client=client, instructions="You are a helpful agent.", context_providers=[skills()])
asyncio.run(agent.run("Hello!"))

It caches skills by default, so restart the process after decimalai skills update.

No DecimalAI package. The whole skill goes in every prompt, and nothing pins or updates it.

Copy SKILL.md

Save it in your project, as

.agents/skills/hoangnb24-onboard-repository/SKILL.md

Give it to your agent

import asyncio
from pathlib import Path
from agent_framework import Agent

skill = Path(".agents/skills/hoangnb24-onboard-repository/SKILL.md").read_text()
agent = Agent(client=client, instructions=f"You are a helpful agent.\n\n{skill}")
asyncio.run(agent.run("Hello!"))

This gets SKILL.md only. The skill's 4 other files are not included.

Other ways to add it

Microsoft Agent Framework docs

Strands' own skill loader reads the installed folder. No DecimalAI account needed.

Install

pip install "decimalai>=0.16" strands-agents
decimalai skills add hoangnb24-onboard-repository

Add it to your agent

from decimalai.strands import skills
from strands import Agent
from strands.vended_tools import file_editor, shell

agent = Agent(
    model=model,                # always pass one: the default is Amazon Bedrock
    system_prompt="You are a helpful agent.",
    tools=[file_editor, shell],
    plugins=[skills()],
)
agent("Hello!")

Strands loads an agent's skills once, so build the agent again after decimalai skills update.

The same install from Python, for a notebook or a setup script. Strands' own skill loader reads the installed folder. No DecimalAI account needed.

Install

pip install "decimalai>=0.16" strands-agents

Add it to your agent

from decimalai import skillpkg

# Writes .agents/skills and .decimal/skills.toml. Safe to run twice.
result = skillpkg.add("hoangnb24-onboard-repository")
if result.exit_code:
    raise SystemExit(result.problems)

from decimalai.strands import skills
from strands import Agent
from strands.vended_tools import file_editor, shell

agent = Agent(
    model=model,                # always pass one: the default is Amazon Bedrock
    system_prompt="You are a helpful agent.",
    tools=[file_editor, shell],
    plugins=[skills()],
)
agent("Hello!")

Strands loads an agent's skills once, so build the agent again after decimalai skills update.

No DecimalAI package. The whole skill goes in every prompt, and nothing pins or updates it.

Copy SKILL.md

Save it in your project, as

.agents/skills/hoangnb24-onboard-repository/SKILL.md

Give it to your agent

from pathlib import Path
from strands import Agent

skill = Path(".agents/skills/hoangnb24-onboard-repository/SKILL.md").read_text()
agent = Agent(model=model, system_prompt=f"You are a helpful agent.\n\n{skill}")
agent("Hello!")

This gets SKILL.md only. The skill's 4 other files are not included.

Other ways to add it

Strands docs

Adds every file the skill has, pinned so you can update it. Cursor, Copilot, Cline and Warp read this folder by themselves.

pip install "decimalai>=0.15"
decimalai skills add hoangnb24-onboard-repository

No Python or account. Cursor, Copilot, Cline and Warp read this folder by themselves.

Save it into your project

curl -fsSL --create-dirs -o .agents/skills/hoangnb24-onboard-repository/SKILL.md https://app.decimal.ai/s/hoangnb24-onboard-repository/SKILL.md

Copy SKILL.md

Save it in your project, as

.agents/skills/hoangnb24-onboard-repository/SKILL.md

This gets SKILL.md only. The skill's 4 other files are not included.

Other ways to add it

Cursor and other editors docs

Fetch the file and give its text to your model as instructions. No account or package needed.

Get the file

curl -fsSL https://app.decimal.ai/s/hoangnb24-onboard-repository/SKILL.md

Read the summary as JSON

curl -fsSL https://app.decimal.ai/s/hoangnb24-onboard-repository.json

This gets SKILL.md only. The skill's 4 other files are not included.

Other ways to add it

Other setups docs

You don't need a DecimalAI account.

Version: v3 (v2 tested 8/17/2026)
Source: hoangnb24/repository-harness ↗
License: MIT

Manage it in DecimalAI

Saved prompts and skills, pinned versions, and traces of this skill in your runs. DecimalAI does not run your agent.

Claude Code reads files from your project, so DecimalAI config does not apply there.

On Claude Agent SDK: save the skill to an agent here, set DECIMAL_API_KEY, and the same code uses it with no command to run. Changes you save reach the next run with no redeploy.

On OpenAI Agents: save the skill to an agent here, set DECIMAL_API_KEY, and the same code uses it with no command to run. Changes you save reach the next run with no redeploy.

On OpenAI SDK: save the skill to an agent here, set DECIMAL_API_KEY, and the same code uses it with no command to run. Changes you save reach the next run with no redeploy.

On Anthropic: save the skill to an agent here, set DECIMAL_API_KEY, and the same code uses it with no command to run. Changes you save reach the next run with no redeploy.

On Gemini API: save the skill to an agent here, set DECIMAL_API_KEY, and the same code uses it with no command to run. Changes you save reach the next run with no redeploy.

On LangChain: save the skill to an agent here, set DECIMAL_API_KEY, and the same code uses it with no command to run. Changes you save reach the next run with no redeploy.

On CrewAI: set DECIMAL_API_KEY and add decimalai.init(crewai=True) to record runs and skill use. The skill version stays in your repo.

On Google ADK: save the skill to an agent here, set DECIMAL_API_KEY, and the same code uses it with no command to run. Changes you save reach the next run with no redeploy.

On Pydantic AI: save the skill to an agent here, set DECIMAL_API_KEY, and the same code uses it with no command to run. Changes you save reach the next run with no redeploy.

On Deep Agents: set DECIMAL_API_KEY and add decimalai.init(langchain=True) to record runs and skill use. The skill version stays in your repo.

On Microsoft Agent Framework: set DECIMAL_API_KEY and add decimalai.init(otel=True, agent_name="support") to record runs and skill use. The skill version stays in your repo.

On Strands: set DECIMAL_API_KEY and add decimalai.init(otel=True, agent_name="support") to record runs and skill use. The skill version stays in your repo.

Editors read files from your project, so DecimalAI config does not apply there.

Anywhere else: record a use with decimalai.log_skill_activation() inside a trace.

Use this skill

SKILL.md

Onboard Repository

Turn an unfamiliar repository into a verified map for future work. Treat the repository as the system of record. Separate facts from gaps and suggestions.

Safety Contract

The first pass is always inspection and proposal only, even when the worktree is writable.

Read every applicable AGENTS.md before inspecting deeper files.
Capture the initial Git root, revision, branch, status, and worktree list.
Preserve all pre-existing tracked and untracked changes.
In the initial boundary capture, before deeper repository inspection, record pre-state existence or safe hashes for relevant ignored state such as .env.local, dependency directories, and managed repository state. Never print secret contents. If an initial baseline was missed, report pre/post equivalence as Unknown; a later sample cannot reconstruct it.
Treat ignore rules and managed-state manifests as part of the boundary, not deeper inspection. Read them before fixing the baseline, enumerate every relevant ignored database, sidecar, dependency, environment, build, and managed-state path they reveal, and record each one explicitly. For ignored directories, use a content-sensitive per-file hash inventory; a filenames- only hash does not prove that contents stayed unchanged.
Use only read-only discovery commands. Do not install dependencies, start services, invoke migrations, create caches or state, or edit files.
Use task-prefixed shell variable names. In zsh, never assign to special names such as path, status, pipestatus, commands, or their uppercase system counterparts; corrupting the inspection shell invalidates later baselines.
Do not create temporary files inside or outside the repository. Compare via stdout and non-materializing pipelines; if a comparison requires a file, report that limitation instead of creating one.
Do not use shell heredocs or here-strings; shells may materialize them as temporary files. Use quoted python3 -c/node -e programs, stdin pipes, or ordinary read-only commands instead.
When a runtime manager is relevant, capture its observable project, service, volume, and process state in the initial boundary batch. If the manager is unavailable, state that runtime pre/post equivalence is Unknown. Proving that no runtime command was issued does not prove runtime state was unchanged.
Before invoking a repository-local binary, verify that its path exists and is executable. If absent, record the command as unavailable; do not invoke, install, rebuild, or substitute it.
Do not turn code, tests, configuration, conventions, or guesses into product intent. They can prove present behavior, not missing normative policy.
Stop when authority is absent or materially different interpretations remain.
End by comparing Git status and diff with the captured initial state.

An explicit later approval may authorize documentation changes. It never authorizes application-code changes, invented product policy, hooks, databases, or background automation unless the user separately requests them.

First Pass: Inspect And Propose

1. Establish the boundary

Read applicable instructions and the smallest repository map available. Record pre-existing dirt before doing anything else. If instructions conflict, follow the narrower instruction and report the conflict.

When .harness-core/manifest.json exists and an installed managed file conflicts with .harness-core/base/<path>, treat the installed file as active instructions for the current run. For a correction proposal, verify the base file against its manifest checksum and show the conflict. Propose replacing only content inside managed markers and preserve all consumer-owned content outside them. Do not treat the managed base as permission to edit.

A checksum-verified conflict in an active mandatory instruction that caused a failed, unavailable, or unsafe command is the first proposal priority. Preview that correction before proposing additive documentation elsewhere.

2. Find repository authority

Inspect only material needed to understand the requested path, normally:

root overview and developer documentation;
product and architecture sources;
package/build manifests and task runners;
CI workflows and deployment/runtime configuration;
focused tests, fixtures, and operational scripts.

For every important claim, cite an exact repository path and classify it:

Authoritative: an instruction, accepted decision, product contract, or explicitly documented operational procedure states what must happen.
Observed: code, configuration, or tests show current behavior.
Derived: a direct operational consequence of verified implementation or configuration. Phrase it as current behavior, not intended or durable policy.
Decision required: a proposed normative, product, or safety policy has no existing authority and requires an explicit user choice.
Unknown: the repository does not establish the answer.

Never silently promote Observed, Derived, Decision required, or Unknown to Authoritative.

Treat operational authority as context-specific. A command or flag documented for CI, a container build, release automation, or another runbook proves only that context. Do not transplant it into a local developer procedure unless the local owning document authorizes it or the user chooses it. When two viable commands differ, do not select one as a Derived rule; classify the choice as Decision required.

When evidence comes from a type, schema, or serializer, distinguish required from optional fields. Say that optional fields appear only when present; a field's existence in a schema does not prove that every emitted record has it.

Verify every clause and qualifier in a proposed sentence independently. Do not generalize configurability, defaults, optionality, ownership, or lifecycle from one field or resource to an adjacent one merely because they appear together.

For environment-derived behavior, trace each claimed key from every source to its final consumer. Distinguish same-key merge precedence, fallback between different keys, checked-in values that make later fallbacks unreachable on the default path, and assignments performed after a merge. Never summarize this as "the environment overrides the files" unless that is true for every named key.

List related identifiers separately and label each one fixed, defaulted, or configurable, with its own source. Apply the same rule to ports, paths, and resource names: state both configurability and fallback when either exists. Assign each write to the stage where it actually occurs rather than grouping later interface writes into setup or readiness.

The current task or frozen evaluation prompt defines run scope, not durable repository authority. A new rule supported only by that prompt is Decision required unless the user explicitly adopts it as repository policy.

2a. Compare documented invariants with executable checks

During the read-only proposal pass, compare accepted architecture, reliability, security, and quality invariants with the repository's checked-in validation. This is an inventory, not authority to edit or enforce.

Use one row per invariant or check:

Documented invariant or executable check	Authority and source	Validation owner and command	Local coverage	CI discovery	Finding

Classify findings precisely:

Enforced: accepted authority and a mechanical check cover the same scope.
Partially enforced: the check covers only part of the accepted scope.
Unenforced rule: accepted authority exists, but no matching check was found.
Check lacking authority: a check exists, but no accepted source establishes its policy. Code, tests, conventions, and defaults cannot fill this gap.
Unknown: available evidence cannot establish the relationship.

Inspect the native validation owner and checked-in CI invocation separately. A local command, an optional hook, CI configuration, and external branch protection are different enforcement levels; do not infer one from another.

Do not add, edit, delete, enable, or execute a guard during onboarding. Do not install hooks or mutate CI, merge, or branch-protection settings. Report the mismatch with evidence and propose the smallest next step: encode an accepted rule, obtain a missing decision, or investigate an unknown. Any later edit or enforcement still requires exact user approval and the repository authority gate.

3. Trace one complete operational path

Prefer one already-documented local happy path over a broad architecture summary. Trace cause and effect through:

prerequisites
-> start
-> readiness
-> deterministic setup
-> real interface exercise
-> evidence and correlation boundary
-> stop and cleanup

Use this exact operational-path table schema; do not merge columns:

Stage or branch	Command/interface and expected result	Classification and source	Write at this stage	Process/container owner	Host and container ports	Evidence/log boundary and correlation	Cleanup at this stage	Unknowns

Include a value or N/A/Unknown in every cell. An omitted or implicit cell fails the operational-path gate; prose elsewhere does not replace it.

Trace lifecycle flags as separate table rows. At minimum, include default startup, each no-start mode, cleanup requested after success, and failure after startup. For a no-start mode, continue tracing later schema, probe, interface, and write behavior rather than assuming the flag makes the whole run read-only. Verify whether cleanup is unconditional, after assertions, or in a finally/trap path. "No teardown command is invoked" does not prove that every service remains running, and a cleanup flag must not be described as guaranteed when earlier failure bypasses it.

Classify cleanup mechanics separately from cleanup obligations. Existing code or an authorized command may prove how cleanup can be performed; it does not create a new instruction that an operator must perform cleanup after a specific failure. Put that obligation in Decision required unless repository authority already states it.

If a read-only inspection contacts a runtime manager such as Docker, capture the relevant project/container identifiers and pre/post state. Never describe logs as instance-local merely because they are container logs; identify the actual project/container boundary and correlation identifiers.

Before the path table, add a resource-and-identifier ledger:

Item	Kind	Exact behavior or value	Classification and source

Use one row per identifier, port, project, service, volume, state path, and log boundary. Kind must distinguish fixed, defaulted, configurable, generated, logical configuration name, and observed runtime name. For port mappings, list host and container sides separately. Never report a logical Compose volume key as an observed engine-level volume name.

One row means one item: do not combine two identifiers or resources in a single row even when their classification is identical. Record checked-in values that make later fallbacks unreachable on the documented default path. For logs, state which fields are guaranteed and which are optional; optional identity or warning fields make evidence request-correlatable only when present. Keep process-wide metrics separate from request- or instance-correlated evidence.

Source the entire causal chain for each effect. An HTTP controller does not by itself prove persistence, and a runner call does not by itself prove provider, logging, database, or runtime-manager consequences. Mark direct implementation facts Observed and consequences of a called tool or protocol Derived. Pre-existing resources under a no-start mode have Unknown creator/owner unless the repository or runtime observation identifies it.

Do not execute the path during the first pass. The goal is to learn whether a fresh agent could execute it without undocumented human help.

4. Propose the smallest useful backfill

Propose only missing knowledge or navigation; do not write it. When existing code, interfaces, commands, tests, and examples already explain the inspected path, retain references in the map and return no proposals. Do not create summary documentation merely to produce a patch. Each proposed item must include:

the concrete agent failure it prevents;
evidence and exact source paths;
the exact destination file or existing section;
the factual content to add or correct;
what remains unknown and must not be claimed;
how a fresh agent replay would prove improvement.

Show all six headings for every proposal, including Unknowns: none when no unresolved factual claim affects that proposal. Do not infer completion of a field from prose in another section.

Prepare an exact patch preview. Classify and cite every proposed sentence, not merely the proposal containing it. The approval unit is the machine-emitted hunk ID, destination, and patch digest, not a proposal number or an ambiguous alternative.

Never handwrite unified-diff headers, line ranges, context, or patch hashes. Construct the complete proposed destination image in memory from the pinned destination, preserving every byte outside the intended edit. Pipe those complete bytes to the bundled renderer:

<non-materializing command that prints the complete after image> |
  python3 .agents/skills/onboard-repository/scripts/render_patch.py \
    --repository <tested-root> \
    --revision <full-tested-revision> \
    --destination <repository-relative-path> \
    --hunk-id H1

Use the standalone renderer only as a preflight when needed. Do not copy its output into the final answer or manually repair it. Correct the complete after image and rerun it. The final bundle emitter invokes the same renderer and produces the canonical marked diff and digests. A renderer failure excludes that proposal from the approval bundle. Rendering is read-only and creates no draft file.

Give every emitted diff hunk a stable H1, H2, ... identifier. The emitter wraps it exactly as follows:

<!-- ONBOARDING_PATCH:H1:BEGIN -->
```diff
<one complete diff hunk>
```
<!-- ONBOARDING_PATCH:H1:END -->

The hunk digest is SHA-256 over the exact UTF-8 bytes inside the diff fence, including one final newline and excluding the fence lines. Do not reuse an identifier or place two hunks inside one marker pair.

For control-flow wording, cite every branch needed to prove the whole clause: flag parsing, startup, checks, failure handling, and teardown as applicable. A single line that initializes a flag or collection does not prove later lifecycle behavior.

Treat temporal words as causal claims. Before writing before, after, successful, complete, or finally, locate the exact success/failure signal and every awaited operation around it. If teardown runs before the success signal and can itself fail, say after all preceding checks succeed, the runner attempts teardown; do not call it teardown after a successful run.

Do not promote a sentinel or partial probe into an aggregate claim. Wording such as the schema, the configuration, all required resources, or the system is ready requires an enumerated membership boundary and evidence for every member. Otherwise name the exact object checked, such as checks whether processed_webhook_events exists. One table probe does not prove that a multi-table schema is present.

Phrase negative lifecycle evidence narrowly. Skipping or bypassing a teardown call proves only that this runner does not invoke that teardown; it does not prove resources remain running. Prefer the runner does not invoke Compose down over the runner leaves the stack running unless runtime evidence proves the stronger state.

Before displaying a command as new runbook guidance, require authority from the same operational context. Code may prove that dependencies are required, but a CI install command does not determine the approved local install command or flags.

Order proposals by causal leverage:

correct a false, stale, or conflicting active instruction;
link to existing authoritative guidance;
add narrowly missing current operational mechanics;
request a new normative decision only when the observed task requires it.

Use the existing file that already owns the operational procedure. Do not add current runbook guidance to a generic, historical, or future-contract document when a maintained operations guide exists. Never put an Unknown sentence in a patch preview; keep it in the gap report until authority or a user decision exists.

When no maintained operational guide exists, use docs/templates/application-runbook.md only to structure a proposed consumer-owned guide. The template supplies headings, not commands or authority: omit unsupported instructions from the patch and retain them as unknowns.

Prefer a correction to an existing repository-owned document over a new framework. Do not propose generic adapters, hooks, state markers, databases, or generated architecture unless the observed failure requires them.

5. Emit a machine-authenticated evidence bundle

Read references/evidence-capsule-v2.md completely before constructing the capsule. Follow its exact field names, vocabularies, and hash definitions.

Do not manually copy source, patch, producer, or destination hashes into the final answer. Build one compact JSON spec in memory and pipe it to scripts/emit_evidence_bundle.py. The spec contains boundary rows, atomic claims with unhashed source ranges, complete proposed destination images, unknowns, and limitations. The emitter reads every pinned blob, computes every digest, renders each patch, and writes one authenticated bundle to stdout without creating a draft file.

For no backfill, supply empty claims and hunks arrays. Keep all four boundary rows and limitations; authentication and no-mutation reporting still apply. There are no patch IDs or edits to approve in this outcome.

<non-materializing command that prints the JSON spec> |
  python3 .agents/skills/onboard-repository/scripts/emit_evidence_bundle.py \
    --repository <tested-root> \
    --revision <full-tested-revision> \
    --branch <tested-branch>

Run the emitter as the final tool call with an output budget large enough to retain the complete result. Do not rerun it unless it fails. Do not reproduce its patch or capsule bytes in the assistant message. The raw tool result is the auditable artifact; the final answer reports its bundle digest, hunk IDs, destinations, classifications, gate result, and exact approval instruction.

Use schema onboarding-evidence-capsule/v2. The emitted capsule is an authenticated index, not authority. It contains exactly:

tested_repository: absolute root, full 40-character revision, and branch;
producer_skill: repository-relative skill path and file SHA-256;
boundary: separate rows covering git, ignored_or_managed, runtime, and temporary_paths, with normalized initial/final evidence hashes and a Pass, Fail, or Unknown result;
claims: one atomic, single-line proposed clause per ID, its hunk ID, Authoritative/Observed/Derived classification, and every exact source;
hunks: destination, whole-file destination hashes before and after in-memory patch application, displayed patch hash, claim IDs, and unresolved unknowns;
limitations: remaining audit or environment limitations.

For each source spec record the repository-relative path, inclusive start/end lines, and role. Set revision only when it differs from the tested revision. The emitter adds the pinned revision and SHA-256 of the exact LF-terminated range. Never cite a working-tree line without a pinned revision. Split conjunctions into atomic claim records even when they remain one natural-language sentence.

Repeat each claim's complete causal chain inside its capsule sources; prose citations elsewhere do not satisfy the capsule. For a command-controlled effect, include the package/entry command mapping, flag-to-branch mapping, branch ordering, and the called implementation that performs the effect.

Make each capsule claim one subject-condition-effect fact. Split sentinel lookup, branch selection, named path, file read, subprocess call, failure propagation, and cleanup absence into separate claims even when the patch uses one natural-language sentence. When a claim names an exact constant, path, or fallback, cite both its definition and its use. When a claim says a failure bypasses later work, cite the awaited call, the callee or assertion that rejects/throws, and the top-level handler; the callsite alone does not prove propagation.

For a boundary row, Pass requires equal non-null initial and final hashes; Fail requires two different hashes; use Unknown when either observation is missing or cannot prove equivalence. Hash stable normalized observation output, not terminal decoration or timestamps. The capsule must reflect Unknowns from the prose gate rather than silently upgrading them.

When the sibling audit skill is installed, its read-only validator is:

python3 .agents/skills/audit-onboarding-proposal/scripts/validate_evidence_capsule.py --transcript <raw-session.jsonl> --expected-transcript-sha256 <sha256> --repository <tested-worktree>

The validator can run only after the transcript exists. For new runs it extracts the last complete machine bundle emitted before task completion and verifies its bundle digest, pinned producer and source blobs, and whole-file patch application. Legacy transcripts with capsules in the completed assistant message remain readable. Do not create a local draft merely to prevalidate the final answer.

6. Report the gate

End the first pass with:

pinned revision and initial dirty state;
operational-path table with evidence classifications;
ranked proposal items;
exact machine-emitted patch preview with a classification and source for each added or changed claim;
the verified managed-marker replacement diff when active managed guidance is stale;
one machine-emitted v2 evidence bundle whose marked patches, identifiers, and computed hashes cover every proposed clause;
blockers and unsupported claims avoided;
final Git status/diff comparison;
pre/post ignored-state and runtime-ownership comparison where relevant, explicitly marking any missed or unobservable baseline Unknown;
the exact patch wording that must be approved for any change.

The gate passes only when repository authority was read, the complete path table contains every required field, every patch sentence passes clause-level evidence review, the run stopped at suggestions, and all required no-mutation comparisons are proven. Git cleanliness alone cannot satisfy the last gate.

Compute the no-mutation gate conjunctively. Git state, every relevant ignored or managed path, runtime ownership, and every task-owned prohibited temporary path must each have proven pre/post equivalence; any required Unknown makes this gate fail. Do not convert an unknown into a pass because no mutating command was observed. A discovered repository gap does not by itself fail a methodological gate; score the five gate conditions, not repository readiness.

Before assigning scores, perform a contradiction scan:

each resource/identifier has exactly one ledger row;
every checked-in default and fallback-reachability qualifier is present;
guaranteed and optional log fields are separated;
process-wide evidence is not called instance-local;
every write is in the stage where it occurs and cites its full causal chain;
absence of cleanup is not promoted to runtime liveness;
every Unknown is reflected in the conjunctive gate result; and
intermediate mistakes corrected during inspection do not remain in the final map, patch, evidence ledger, or score.

If the final state differs from the initial state, disclose every difference and treat the pass as failed. Do not repair or erase user-owned changes.

Later Pass: Apply Approved Items

Apply only when the user approves the exact displayed patch wording.

Re-read applicable instructions and capture current Git state.
Recheck target-file hashes and recompute the proposal if they changed.
For normative product claims, require existing authority or an explicit user decision. For current operational mechanics, require direct observed evidence, preserve the evidence classification, and phrase them as current behavior. Keep unknowns explicit.
For verified managed-file drift, replace only approved managed-marker content and preserve consumer-owned content outside the markers.
Edit only the approved agent-facing documentation or knowledge files.
Match existing repository structure and terminology; keep the patch small.
Run relevant documentation checks and any repository-prescribed validation.
Inspect the complete diff for invented policy or unrelated changes.
Rerun this skill's inspection logic. It must not propose duplicate content.
Produce a documentation-only replay patch that can be applied to the baseline commit without carrying this skill or other experimental files.
Report changed files, validation evidence, remaining gaps, and the frozen prompt for a separate fresh-agent replay.

When new choices appear during application, stop and return them for approval.

Concrete Example

Suppose a repository documents pnpm local:e2e, its test runner observes /health and /chat, and the root onboarding guide points to a nonexistent binary. A verified managed base contains newer instructions without that binary.

The first pass follows the active root instructions, reports the unavailable binary, verifies the managed-base checksum, and leaves Git unchanged. Its patch preview replaces only the stale managed block and links the existing E2E procedure. Any new cleanup rule is classified Decision required. It must not claim a new chat contract or add a universal startup script. After the user approves exact patch wording, the later pass applies it and produces a skill-free documentation patch for a fresh replay. Success is fewer undocumented hints and safer command ordering, not merely more documentation.

When it activates

Automatically, when a task matches. Use when explicitly asked to onboard, map, assess, or backfill agent-facing repository guidance; use again after the user approves exact proposal items. The first pass is read-only and must not edit files, install tools, start services, create state, or infer missing product policy.

About this skill

Automatic

Coding pack

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v5 — 10/9/2026

View 15 scanner checks

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

hoangnb24 / repository-harness

.agents/skills/onboard-repository/SKILL.md

View on GitHub ↗

License MITImported 10/9/2026Version v3Bundled 4 files · scripts

Illustrative Want to see what hoangnb24/onboard-repository would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Related skills

Skills that do similar work, with their headline benchmark lift.

From the same source and nearby in the catalogue.

Ready to supercharge your AI agents?

Safety

What it changes

Track record

Use this skill

Onboard Repository

Safety Contract

First Pass: Inspect And Propose

1. Establish the boundary

2. Find repository authority

2a. Compare documented invariants with executable checks

3. Trace one complete operational path

4. Propose the smallest useful backfill

5. Emit a machine-authenticated evidence bundle

6. Report the gate

Later Pass: Apply Approved Items

Concrete Example

When it activates

SkillSafety

Source

Related skills

More in the registry