codebase-onboarding
>
它会碰到什么
逐条看命中(26 条严重或高危)
- 严重
references/documentation-templates.md:66cred-paths| 5 | `.env.example` | All environment variables with descriptions | Setup day |
- 严重
references/documentation-templates.md:102cred-pathscp .env.example .env
- 严重
references/documentation-templates.md:102cred-pathscp .env.example .env
- 严重
references/documentation-templates.md:103cred-paths# Edit .env — minimum required values:
- 严重
references/documentation-templates.md:132cred-paths- [ ] You can log in with the seeded test user (see .env.example for credentials)
- 严重
references/fact-gathering-and-patterns.md:53cred-pathsgrep -rh "process\.env\.\|os\.environ\.\|os\.getenv" src/ app/ lib/ --include="*.ts" --include="*.py" 2>/dev/null | \
- 严重
references/quality-and-best-practices.md:44cred-paths| Environment variable list is incomplete | `grep` scan missed dynamically constructed variable names | Supplement grep results with a manual review of config l
- 严重
scripts/onboarding_generator.py:73cred-paths"LICENSE", ".env.example", ".env.sample", "Makefile",
- 严重
scripts/onboarding_generator.py:73cred-paths"LICENSE", ".env.example", ".env.sample", "Makefile",
- 严重
scripts/onboarding_generator.py:98cred-pathsif not f.startswith(".") or f in KEY_FILE_NAMES or f.startswith(".env"): - 严重
scripts/setup_validator.py:4cred-pathsChecks for README, .env.example, Makefile/scripts, required tools,
- 严重
scripts/setup_validator.py:87cred-pathsenv_file = _file_exists(root, ".env.example", ".env.sample", ".env.template", ".env.defaults")
- 严重
scripts/setup_validator.py:87cred-pathsenv_file = _file_exists(root, ".env.example", ".env.sample", ".env.template", ".env.defaults")
- 严重
scripts/setup_validator.py:87cred-pathsenv_file = _file_exists(root, ".env.example", ".env.sample", ".env.template", ".env.defaults")
- 严重
scripts/setup_validator.py:87cred-pathsenv_file = _file_exists(root, ".env.example", ".env.sample", ".env.template", ".env.defaults")
- 严重
scripts/setup_validator.py:96cred-pathselse "Add .env.example listing all required environment variables with descriptions"
- 严重
scripts/setup_validator.py:100cred-paths# 3. .env not committed (check .gitignore)
- 严重
scripts/setup_validator.py:107cred-pathsline.strip() in (".env", ".env*", ".env.*", ".env.local") - 严重
scripts/setup_validator.py:107cred-pathsline.strip() in (".env", ".env*", ".env.*", ".env.local") - 严重
scripts/setup_validator.py:107cred-pathsline.strip() in (".env", ".env*", ".env.*", ".env.local") - 严重
scripts/setup_validator.py:107cred-pathsline.strip() in (".env", ".env*", ".env.*", ".env.local") - 严重
scripts/setup_validator.py:112cred-pathsenv_committed = (Path(root) / ".env").exists()
- 严重
scripts/setup_validator.py:115cred-paths"name": ".env excluded from version control",
- 严重
scripts/setup_validator.py:120cred-paths"found": ".gitignore has .env pattern" if env_ignored else None,
- 严重
scripts/setup_validator.py:123cred-pathselse "SECURITY: .env file is committed! Add .env to .gitignore and remove from tracking"
- 严重
scripts/setup_validator.py:123cred-pathselse "SECURITY: .env file is committed! Add .env to .gitignore and remove from tracking"
这一栏是扫描器报的事实,不是结论。命中多不等于有毒(安全工具、规则库、示例脚本本来就会包含危险写法),命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系,需要你自己看。
技能内容
Codebase Onboarding
Analyze any codebase and generate production-quality onboarding documentation tailored to the audience. Produces architecture overviews with system diagrams, annotated key file maps, step-by-step local setup guides, common developer task runbooks, debugging guides with real error solutions, and contribution guidelines. Supports Markdown, Notion, and Confluence output formats.
Core Capabilities
- Architecture analysis — tech stack identification from manifests/lockfiles, system boundary mapping, Mermaid data-flow diagrams, dependency graphs, module ownership.
- Key file annotation — surface the 20 most important files and why they matter; mark entry points, config hubs, shared utilities, and files dangerous to modify without coordination.
- Setup guide generation — prerequisites with exact versions,
git clone-to-tests steps, env-var docs, infra setup (Docker/DB/cache), and a verification checklist. - Task runbooks — add an API endpoint, run/write tests, create & apply migrations, deploy to staging/production, add a dependency safely.
- Debugging guide — common errors with exact messages and fixes, log locations by environment, diagnostic SQL/CLI queries, local reproduction of production issues.
- Audience-aware output — tailored additions for junior developers, senior engineers, and contractors; Markdown / Notion / Confluence formats.
Keywords: codebase onboarding, developer experience, documentation, architecture overview, setup guide, debugging guide, contribution guidelines, code walkthrough, new hire onboarding
When to Use
- Onboarding a new team member (junior, senior, or contractor)
- After a major refactor that made existing docs stale
- Before open-sourcing a project
- Creating a team wiki page for a service you own
- Self-documenting before a long vacation or team transition
- Preparing for a compliance audit that requires documentation
Clarify First
Before generating the docs, confirm these inputs. If any is unknown or vague, ASK — do not assume:
- [ ] Target codebase path — which project to analyze (the input all three scripts scan)
- [ ] Audience — junior developer, senior engineer, or contractor (tailors which sections appear and at what depth)
- [ ] Output format — Markdown, Notion, or Confluence (sets the generated document format)
Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the artifact.
Tools
| Tool | Purpose | Command |
|------|---------|---------|
| architecture_mapper.py | Analyze project structure and generate a high-level architecture map | python scripts/architecture_mapper.py /path/to/project --json |
| onboarding_generator.py | Scan a project directory and generate an onboarding guide | python scripts/onboarding_generator.py /path/to/project --json |
| setup_validator.py | Validate a project's development setup completeness | python scripts/setup_validator.py /path/to/project --json |
All tools accept an optional directory argument (default: current directory) and --json for machine-readable output.
References
Load the reference that matches the task — keep this file lean and pull detail on demand:
- [references/fact-gathering-and-patterns.md](references/fact-gathering-and-patterns.md) — the Phase 1 fact-gathering shell commands and the Phase 2 architecture-pattern classification table. Read when analyzing a codebase before writing docs.
- [references/documentation-templates.md](references/documentation-templates.md) — the architecture overview, key file map, local setup, and debugging guide templates plus audience-specific (junior/senior/contractor) additions. Read when generating the actual onboarding documents.
- [references/quality-and-best-practices.md](references/quality-and-best-practices.md) — quality verification checklist, common pitfalls, best practices, a troubleshooting matrix, and success criteria. Read before shipping onboarding docs.
Scope & Limitations
This skill covers:
- Generating architecture overviews, key file maps, setup guides, task runbooks, and debugging guides from codebase analysis
- Audience-aware documentation tailored for junior developers, senior engineers, and contractors
- Output in Markdown, Notion, and Confluence formats
- Quality verification checklists and freshness audit processes
This skill does NOT cover:
- Automated API reference generation from code annotations — see
engineering/changelog-generatorfor release-oriented docs orengineering/api-design-reviewerfor API quality - Continuous documentation pipelines or CI-triggered doc builds — see
engineering/ci-cd-pipeline-builderfor pipeline automation - Security-focused documentation such as threat models or access control matrices — see
engineering/skill-security-auditorfor security auditing - Runbook generation for incident response and production operations — see
engineering/runbook-generatorfor operational runbooks
Integration Points
| Skill | Integration | Data Flow |
|-------|------------|-----------|
| engineering/runbook-generator | Onboarding task runbooks can seed operational runbooks for production incident response | Onboarding runbook templates → Runbook Generator for ops-grade expansion |
| engineering/api-design-reviewer | API route analysis from Phase 1 feeds into API design quality reviews | Discovered API endpoints → API Design Reviewer for consistency checks |
| engineering/database-schema-designer | Database schema files identified during key file mapping inform schema design reviews | Schema file paths and ORM type → Schema Designer for migration planning |
| engineering/tech-debt-tracker | Technical debt items surfaced during architecture analysis should be logged for tracking | Architecture analysis findings → Tech Debt Tracker backlog entries |
| engineering/ci-cd-pipeline-builder | CI/CD config discovered in Phase 1 can be validated and improved by the pipeline builder | CI config paths and workflow list → Pipeline Builder for optimization |
| engineering/dependency-auditor | Dependency counts and lockfiles gathered in Phase 1 feed directly into security and license audits | Package manifests and lockfiles → Dependency Auditor for vulnerability scanning |
想直接用这个技能?
本站把开放许可(MIT / Apache 等)的技能按仓库打包整理到网盘,点一下转存到你自己的网盘,不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接,不打包。