Cloud Agent Onboarding

Overview

Make a repository work in hosted cloud coding agents (Claude Code on the web, Codex cloud): assess, environment, secrets, repo instructions, cloud tests, people guide.

This skill ships inside the Cloud Agent Onboarding plugin and can be installed through the Claude Code marketplace or directly in Codex from its skill path.

Parent Surface

Example prompts

• "Make / usable from Claude Code on the web for designers." → assess
• "Add a network secret for our private npm registry to the cloud environment." → access
• "Our cloud sessions fail before Claude starts; fix the setup script." → environment
• "Let staff publish page edits from a cloud session with an approver for code changes." → publish
• "Run the engineer probe against the new environment and report a table." → test
• "Audit our existing cloud setup against this skill." → audit
• "How do Claude cloud and Codex cloud differ for secrets?" → learn

The shape of every project

Four layers to build, in order: access (non-human credentials), the cloud environment, the repo (hook, skill, helper scripts), the people guide. Plus records the whole way through.

Person ─ opens claude.ai/code or chatgpt.com/codex, picks environment + repo
  ▼
Cloud environment (built in the vendor UI)   setup script · network · variables · secrets
  ▼
VM clones the repo → repo-side start-up       SessionStart hook · .mcp.json · user-level fallback
  ▼
Agent reads instructions                      CLAUDE.md → AGENTS.md → repo skill
  ▼
Outside systems (optional)                    private registries · APIs · CLIs · previews
  ▼
Outputs people can open                       artifacts · previews behind sign-in · draft PRs · gated publish

Who does what

This split is the most important thing to repeat. The local agent (you, on an engineer's machine) does the technical work; the human does anything that involves a credential or an outward decision.

The local agent's own safety check blocks that last row even when the human says "go ahead"; plan those steps as human clicks from the start instead of rephrasing around the block.

Rules that always apply

argv, shell history, terminal output, files, screenshots, or the repo. Never screenshot a dialog that holds a pasted value; read its length. When a value must move, the human pastes it or a script reads it from stdin and prints only length and a sha256 prefix. If a value leaks, revoke it at once and record the leak.

filtering values out. CLIs print tokens; never let a mint command write to the terminal.

browser or tab that belongs to the user or another session, and stop if someone is typing in the tab you are about to use. Never call browser.close() on a CDP-attached browser.

new places, sharing artifacts beyond private.

branch names and commits.

in the same session, with pre-state and read-back verification (records).

tools add attribution footers on their own; plan to remove them.

• Secret values never pass through the agent's context. Not in prompts, argv, shell history, terminal output, files, screenshots, or the repo. Never screenshot a dialog that holds a pasted value; read its length. When a value must move, the human pastes it or a script reads it from stdin and prints only length and a sha256 prefix. If a value leaks, revoke it at once and record the leak.
• Never env, printenv, or "show" config that may hold secrets without filtering values out. CLIs print tokens; never let a mint command write to the terminal.
• One browser, its own profile, small steps. Never attach to or close a browser or tab that belongs to the user or another session, and stop if someone is typing in the tab you are about to use. Never call browser.close() on a CDP-attached browser.
• Ask before outward actions: pushes, PRs, closing PRs, labels, deploys to new places, sharing artifacts beyond private.
• Synthetic data only in fixtures, test prompts, screenshots, guides, branch names and commits.
• Keep a numbered change record for every state-changing action, written in the same session, with pre-state and read-back verification (records).
• Follow the target repo's own rules (attribution, branch, review, CI). Cloud tools add attribution footers on their own; plan to remove them.

Resources

Declared allowed tools:

Installation

Switch between Claude Code and Codex, then copy the install command for the runtime you use.

claude plugin marketplace add DiversioTeam/agent-skills-marketplace
claude plugin install cloud-agent-onboarding@diversiotech

CODEX_HOME="${CODEX_HOME:-$HOME/.codex}"
python3 "$CODEX_HOME/skills/.system/skill-installer/scripts/install-skill-from-github.py" \
  --repo DiversioTeam/agent-skills-marketplace \
  --path plugins/cloud-agent-onboarding/skills/cloud-agent-onboarding

Invocation:

/cloud-agent-onboarding:onboard

name: cloud-agent-onboarding