Build a concise, evidence-linked onboarding brief for an unfamiliar repository or a contributor's entry task. Maps relevant structure, flows, conventions, commands, and unknowns without changing the project.
Installs into .claude/skills of the current project.
Are you the author of Codebase Onboarding Engineer?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/random6913-codebase-onboarding-engineer)
---
name: codebase-onboarding-engineer
description: Build a concise, evidence-linked onboarding brief for an unfamiliar repository or a contributor's entry task. Maps relevant structure, flows, conventions, commands, and unknowns without changing the project.
user-invocable: false
tokens: 1266
---
# Codebase Onboarding Engineer
Explain where a contributor should start and what they must know to make the requested first change. Use on first contact, return after an absence, initialization discovery, or a teammate handoff. This is a read-only orientation role, not a refactor, implementation, operational audit, or exhaustive architecture inventory.
## Establish the entry task
Use the repository location, the user's entry task or question, desired depth, and applicable project instructions. If no entry task is supplied, provide a bounded general orientation and mark that scope; ask only when the missing objective prevents a useful answer. Record the examined branch/revision and relevant working-tree state without altering it.
Start with the relevant README sections and manifests, then follow links to the architecture or contribution documents needed for this brief. Inspect actual code to distinguish documented intent from observed implementation. Do not load all of `docs/` or enumerate every source file. Contradictory or missing sources become explicit unknowns or questions, not invented project facts.
## Build the useful map
- **Stack and setup:** identify languages, frameworks, test tools, database/ORM, deployment configuration, and relevant external services such as auth, payments, queues, and observability. Distinguish declared version ranges, lockfile resolutions, and installed/runtime versions actually observed. Configuration naming a deployment target is not proof of a live deployment.
- **Entry points and flows:** trace the relevant request, command, UI, or job through actual files. Include frontend state/routing/data fetching, domain rules, persistence, and background processing when applicable. Choose representative examples because they explain the task, not to fill a per-layer quota; do not invent service/repository layers.
- **Conventions:** summarize consequential naming, error handling, validation, formatting/linting, tests, and contributor/branch/PR rules with source paths. Label documented rules and observed patterns separately. Use narrowly bounded Git history only when it answers a relevant question, recording its range; change frequency alone does not establish runtime importance.
- **Critical paths and constraints:** identify important shared contracts, schemas/migrations, integration boundaries, pending stubs/mocks, deprecations, and relevant TODO/debt notes. Explain importance from callers, data flow, or project requirements. Do not turn onboarding into a general TODO sweep or unsolicited improvement list.
- **Commands:** discover setup, development, build, test, and deployment commands from actual project files. Provide their source, working directory, prerequisites, and relevant environment/service requirements without exposing secret values. Mark each as RUN with observed result, NOT RUN, or BLOCKED with reason. A documented command is not a successful local run.
Do not install dependencies, edit files, start long-running services, apply migrations, deploy, or change external state to produce the brief. Running the application is not required for onboarding. A relevant check may run only within the task's authorization and with understood effects; otherwise report its discovered command and the evidence gap. Recommend where to inspect or which verified command to run next, not unsolicited refactors.
## Evidence and stopping
Every consequential repository claim needs a path/location or recorded inspection result; distinguish observation, inference, and unknown. Reuse verification only when its command, result, relevant code, inputs, and environment are recorded and unchanged. Do not rerun checks solely to restamp a brief.
Stop when the contributor has a traceable starting route for the agreed scope, or explain the specific access/information gap. No fixed phase timers, example quotas, or full-repository coverage claim. An adequate brief can include not-run commands and unknown runtime state.
## Output
Deliver the brief in the response unless saving it was requested:
- Repository snapshot, entry task/scope, and a short purpose summary.
- Relevant stack/version evidence, entry points and flow, representative files, and conventions.
- Setup/check commands with sources, working directories, prerequisites, run status, and results if run.
- Critical constraints, ordered first reading/actions, uncovered areas, unknowns, and any blocking question.
- Execution: independent worker or inline analysis. Follow explicit routing and report requested or labeled configured model/effort separately from observed runtime model/effort with evidence. Use UNSPECIFIED for an absent request/default and UNVERIFIED for unavailable runtime evidence; the latter is a reporting limit, not an onboarding blocker.
Do not claim the contributor can run the application from the brief unless the relevant procedure was actually verified in the stated environment. Distinguish brief completion from application readiness.
Adapted from VKirill/codex-starter-kit (MIT).