Agent skill · Audited from source

Codebase Onboarding

skill · borghei/Claude-SkillsNOASSERTION licenceAudited 19 Oct 2026 · source 6e3fcbdbb5cf

★ 949pushed 12 days agoversion 1.1.0
!CAUTIONGrade B · 87/100 · 6 findings · 6e3fcbd
949repo stars · whole borghei/Claude-Skills

Is it safe? With care — CAUTION, grade B (87/100). We read this skill's source at commit 6e3fcbdbb5cf and found no filesystem, network or shell access and a hard-coded secret (see the findings). The audit raised 6 findings, 0 critical or high. What it does: Analyze a codebase and generate onboarding docs: architecture overviews, file maps, setup guides, runbooks, and debugging guides. Use when onboarding new team members, open-sourcing, or documenting after a major…

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “Codebase Onboarding (borghei/Claude-Skills)”. Retrieved 19 Oct 2026. https://modelsatlas.com/skills/borghei/codebase-onboarding

3 skills are called “Codebase Onboarding”. You are viewing borghei/Claude-Skills.

Trust audit

Audit 0.4.1 · source read 19 Oct 2026

Trust score87/100!CAUTION B
0 critical0 high6 medium0 low0 info

CAUTION means the audit found things worth knowing before you trust this skill. Grade B is shared by 13,985 of 14,816 audited skills.

What the source does

  • FilesystemNone observedNo reads or writes in the source
  • NetworkNone observedNo outbound calls in the source
  • ShellNone observedNo commands run in the source
  • DependenciesPinnedNothing floats
  • SecretsFoundSee the findings; values are never shown

Five audit layers

LayerWhat we checkResultFindings
L0 ProvenanceRepo owner, licence, archive status, activityWARN5
L1 Static sourceSecrets, path traversal, supply chain, hidden codeWARN1
L2 InstructionsPrompt injection, authority framing, hidden directivesPASS0
L3 InventoryThe files and declarations match the sourcePASS0
L4 SandboxRun in isolation and watch behaviourSKIPPED why0

Gates applied: no behavioural pass.

Findings (6)

MEDIUMHard-coded secretssecret.db_uri · references/documentation-templates.md:104
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
#   DATA…://…@localhost:5432/myapp
Why
No further detail recorded for this rule.
Fix
—

Audit 0.4.1 · source sha 6e3fcbdbb5cf · 19 Oct 2026Report an issue or request a re-scan

Provenance

Who published it, and what the verdict is pinned to

  • Publisherborghei GitHub userOwner of the repository this skill is read from
  • Source folderborghei/Claude-Skills/engineering/codebase-onboardingThe exact folder we audited
  • LicenceNOASSERTIONAs the repository states it
  • Commit pinned for this verdict6e3fcbdbb5cfA new audit runs when the source changes
  • Repository statusNot archivedLast push 12 days ago
  • Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

What it tells the agent

Full source on GitHub ↗

Its description: Analyze a codebase and generate onboarding docs: architecture overviews, file maps, setup guides, runbooks, and debugging guides. Use when onboarding new team members, open-sourcing, or documenting after a major…

---
name: codebase-onboarding
description: >
  Analyze a codebase and generate onboarding docs: architecture overviews, file maps, setup
  guides, runbooks, and debugging guides. Use when onboarding new team members, open-sourcing,
  or documenting after a major refactor.
license: MIT + Commons Clause
metadata:
  version: 1.1.0
  author: borghei
  category: engineering
  domain: developer-experience
  tier: POWERFUL
  updated: 2026-06-17
  frameworks: markdown, notion, confluence
---
# Codebase Onboarding

Analyze any codebase and generate production-quality onboarding documentation tailored to the audience. Produces architecture overviews with system diagrams, annotated key file maps, step-by-step local setup guides, common developer task runbooks, debugging guides with real error solutions, and contribution guidelines. Supports Markdown, Notion, and Confluence output formats.

## Core Capabilities

- **Architecture analysis** — tech stack identification from manifests/lockfiles, system boundary mapping, Mermaid data-flow diagrams, dependency graphs, module ownership.
- **Key file annotation** — surface the 20 most important files and why they matter; mark entry points, config hubs, shared utilities, and files dangerous to modify without coordination.
- **Setup guide generation** — prerequisites with exact versions, `git clone`-to-tests steps, env-var docs, infra setup (Docker/DB/cache), and a verification checklist.
- **Task runbooks** — add an API endpoint, run/write tests, create & apply migrations, deploy to staging/production, add a dependency safely.
- **Debugging guide** — common errors with exact messages and fixes, log locations by environment, diagnostic SQL/CLI queries, local reproduction of production issues.
- **Audience-aware output** — tailored additions for junior developers, senior engineers, and contractors; Markdown / Notion / Confluence formats.

**Keywords:** codebase onboarding, developer experience, documentation, architecture overview, setup guide, debugging guide, contribution guidelines, code walkthrough, new hire onboarding

## When to Use

- Onboarding a new team member (junior, senior, or contractor)
- After a major refactor that made existing docs stale
- Before open-sourcing a project
- Creating a team wiki page for a service you own
- Self-documenting before a long vacation or team transition
- Preparing for a compliance audit that requires documentation

## Clarify First

Before generating the docs, confirm these inputs. If any is unknown or vague, ASK — do not assume:

- [ ] **Target codebase path** — which project to analyze (the input all three scripts scan)
- [ ] **Audience** — junior developer, senior engineer, or contractor (tailors which sections appear and at what depth)
- [ ] **Output format** — Markdown, Notion, or Confluence (sets the generated document format)

Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the artifact.

## Tools

| Tool | Purpose | Command |
|------|---------|---------|
| `architecture_mapper.py` | Analyze project structure and generate a high-level architecture map | `python scripts/architecture_mapper.py /path/to/project --json` |
| `onboarding_generator.py` | Scan a project directory and generate an onboarding guide | `python scripts/onboarding_generator.py /path/to/project --json` |
| `setup_validator.py` | Validate a project's development setup completeness | `python scripts/setup_validator.py /path/to/project --json` |

All tools accept an optional `directory` argument (default: current directory) and `--json` for machine-readable output.

## References

Load the reference that matches the task — keep this file lean and pull detail on demand:

- **[references/fact-gathering-and-patterns.md](references/fact-gathering-and-patterns.md)** — the Phase 1 fact-gathering shell commands and the Phase 2 architecture-pattern classification table. Read when analyzing a codebase before writing docs.
- **[references/documentation-templates.md](references/documentation-templates.md)** — the architecture overview, key file map, local setup, and debugging guide templates plus audience-specific (junior/senior/contractor) additions. Read when generating the actual onboarding documents.
- **[references/quality-and-best-practices.md](references/quality-and-best-practices.md)** — quality verification checklist, common pitfalls, best practices, a troubleshooting matrix, and success criteria. Read before shipping onboarding docs.

## Scope & Limitations

**This skill covers:**
- Generating architecture overviews, key file maps, setup guides, task runbooks, and debugging guides from codebase analysis
- Audience-aware documentation tailored for junior developers, senior engineers, and contractors
- Output in Markdown, Notion, and Confluence formats
- Quality verification checklists and freshness audit processes

**This skill does NOT cover:**
- Automated API reference generation from code annotations — see `engineering/changelog-generator` for release-oriented docs or `engineering/api-design-reviewer` for API quality
- Continuous documentation pipelines or CI-triggered doc builds — see `engineering/ci-cd-pipeline-builder` for pipeline automation
- Security-focused documentation such as threat models or access control matrices — see `engineering/skill-security-auditor` for security auditing
- Runbook generation for incident response and production operations — see `engineering/runbook-generator` for operational runbooks

## Integration Points

| Skill | Integration | Data Flow |
|-------|------------|-----------|
| `engineering/runbook-generator` | Onboarding task runbooks can seed operational runbooks for production incident response | Onboarding runbook templates → Runbook Generator for ops-grade expansion |
| `engineering/api-design-reviewer` | API route analysis from Phase 1 feeds into API design quality reviews | Discovered API endpoints → API Desig

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

Install

Pinned to the audited commit 6e3fcbd

Download folder ↗
git clone [repo-url]

Commands as the repository documents them: shown, never run by us. Our verdict covers commit 6e3fcbdbb5cf only.

Works in

The author has not said which agents this skill supports, and we have not tested it in any.

Audit history

Every audit, every source change

  1. !CAUTION B 87 / 100

    first audit · source 6e3fcbdbb5cf

README badge

For maintainers · shows the latest audit

ModelsAtlas: CAUTION BMODELSATLASCAUTION · B
[![ModelsAtlas: CAUTION B](https://modelsatlas.com/skills/borghei/codebase-onboarding/badge.svg)](https://modelsatlas.com/skills/borghei/codebase-onboarding/)

The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.

A11y Audit!CAUTION

borghei/Claude-Skills

This skill should be used when the user asks to "check accessibility", "audit WCAG compliance", "scan HTML for a11y issues", "check color contrast", or "find accessibility violations in web pages".

★ 949Grade B
Agent Designer!CAUTION

borghei/Claude-Skills

Designs multi-agent system architectures with orchestration patterns, tool schemas, and performance evaluation. Use when building AI agent systems, designing agent workflows, creating tool schemas, or evaluating agent…

★ 949Grade B
Agent Protocol!CAUTION

borghei/Claude-Skills

Design AI agent communication protocols: MCP tool schemas, A2A, function calling, and inter- agent messaging. Use when building multi-agent systems, defining tool interfaces, or implementing agent-to-agent communication.

★ 949Grade B
Agent Workflow Designer!CAUTION

borghei/Claude-Skills

Design multi-agent orchestration with workflow DAGs, routing, handoff protocols, and state management. Use when building pipelines of specialized agents, designing fan-out/fan-in patterns, or implementing fault-tolerant…

★ 949Grade B
Agenthub!CAUTION

borghei/Claude-Skills

Multi-agent DAG orchestration for workflows where AI agents collaborate via dependency graphs, covering agent spawning, output merging, and quality evaluation. Use when a task needs multiple specialized agents or to…

★ 949Grade B
Analytics Engineer!CAUTION

borghei/Claude-Skills

Analytics engineering across data modeling, dbt, transformation, and semantic layers. Use when building dbt models, designing star schemas, writing staging or mart SQL, configuring data tests, or optimizing warehouse…

★ 949Grade B

Add this badge to your README

[![ModelsAtlas: CAUTION B](https://modelsatlas.com/skills/borghei/codebase-onboarding/badge.svg)](https://modelsatlas.com/skills/borghei/codebase-onboarding/)

Questions about Codebase Onboarding

What does the Codebase Onboarding skill do?
385 AI skills, 77 expert agents, and 900 stdlib Python tools for every team: engineering, PM, marketing, C-level, compliance, business ops, research, and a LinkedIn toolkit. Installs on Claude Code, Cursor, Codex, Gemini, Copilot, and 6 other AI assistants.
Is Codebase Onboarding safe to install?
With care. The audit graded it B (87/100) and found 6 things worth knowing before you trust this skill, listed below with the exact line each was found on.
What can Codebase Onboarding access on my machine?
The audit observed no filesystem, network or shell use at all in its source.
How current is this page?
The grade is for one exact copy of the source (6e3fcbdbb5cf), read on 2026-10-19. The repository is watched, and a new audit runs when it changes — this is the first audit.

Sources

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.