[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71DZSW28RV3DZRS4HHVARYD":3,"skill-same:01M71DZSW28RV3DZRS4HHVARYD":78},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":43,"linkOnly":44,"markdownContent":45,"markdownBody":46,"frontMatter":47,"refName":49,"commitSha":50,"skillDirectory":51,"forksCount":52,"repositoryHtmlUrl":53,"repositoryHomepageUrl":6,"ownerHtmlUrl":54,"ownerBlogUrl":55,"ownerDescription":56,"updatedAt":57,"install":58,"resources":71},"01M71DZSW28RV3DZRS4HHVARYD","new-hire",null,"Onboard a teammate end to end: invite, role, groups, secrets, file access, and onboarding packet. Also brings existing access up to role.","indigoai-us\u002Fhq-core","indigoai-us","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F122242446?v=4","01M71DTQ5NGD10GT1Z7E6XKWC5","HQ","01M71DTQ6BKSYYBNC9RAKT3YDK",94,"MIT","https:\u002F\u002Fgithub.com\u002Findigoai-us\u002Fhq-core\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fnew-hire\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000038","人力资源","PROFESSION","适用职业",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42],"hire","new hire","new","onboarding","role","groups","write","file access","secrets","read","onboarding packet","onboard","file","Bash","access","Existing","up","end","invite","2026-11-10 10:12:30",false,"---\nname: new-hire\ndescription: \"Onboard a teammate end to end: invite, role, groups, secrets, file access, and onboarding packet. Also brings existing access up to role.\"\nallowed-tools: Bash, Read, Write, AskUserQuestion\n---\n\n# \u002Fnew-hire — Onboard a Human Teammate\n\nOne flow from \"we hired someone\" to \"they have everything their role needs and\nknow where to start.\" The failure mode this skill kills: a new teammate gets an\ninvite email and nothing else — no groups, no secrets, no map of the company —\nand spends their first week asking for access one credential at a time.\n\n**Usage:**\n```\n\u002Fnew-hire                          # interview from scratch\n\u002Fnew-hire {email}                  # onboard a specific person\n\u002Fnew-hire {email} {company}        # skip company resolution\n```\n\nFor **fleet agents** (identities like `agt-…@agents.{your-domain}.ai`), use\n`\u002Fnew-agent` instead — agents need runtime bootstrap and probe verification\nthat humans don't.\n\n## Process\n\n### Who runs these steps\n\nSteps 1–4 are the onboarding admin’s terminal tasks. Run them from a terminal\nwith the HQ CLI signed in to the company account that can invite teammates and\ngrant access. The teammate does not need to run provisioning commands. Their\nsetup is the checklist in Step 5: sign in with `hq login`, accept the invite,\nand pull the company workspace with `hq sync pull --company {co}`.\n\n### 1. Resolve person + company\n\n- Check current state: `hq members list --company {co}`. If the person already\n  has an active membership → **top-up mode**: diff their access against the\n  role's needs and grant only gaps (role changes go through `hq groups` \u002F\n  membership updates, not a re-invite).\n- Company must be in `companies\u002Fmanifest.yaml` and cloud-backed (`cloud_uid`\n  present). Not cloud-backed → route to `\u002Fdesignate-team` first.\n\n### 2. Interview — define the role before the grants\n\nBatched (one AskUserQuestion call, skip anything already known):\n\n1. **Who**: name + email (work email they'll authenticate with).\n2. **Role**: `admin` or `member` in the vault, and their functional role\n   (engineering, finance, ops, design, GTM…) — the function drives the access\n   bundle.\n3. **Access bundle**: which repos, secrets, knowledge areas, and tools does the\n   function need on day one? Prefer naming an existing teammate to mirror\n   (\"same access as X\") — then read X's grants as the template.\n4. **Intro context**: who do they report to, which Slack channels matter, any\n   first-week priorities for the onboarding packet.\n\n### 3. Derive the access bundle\n\nBuild the manifest before granting. For each item, prefer what exists in the\nvault (`hq secrets list --company {co}`) over minting new credentials.\n\n- **Least privilege**: `--permission read` unless their function writes\n  (e.g. an engineer deploying needs write on deploy keys; a finance analyst\n  reading Stripe does not).\n- **Groups first**: if the company uses `hq groups`, add the person to the\n  right group and let group ACLs carry the standing access — per-person shares\n  are for exceptions, not the baseline.\n- **Payment\u002Fproduction keys**: verify scope before sharing (a Stripe key's\n  prefix — `rk_` restricted vs `sk_` full — can be checked without exposure via\n  `hq secrets exec --company {co} --only KEY -- sh -c 'printf %s \"$KEY\" | cut -c1-3'`).\n  Flag full-scope keys to the owner before including them in an onboarding\n  bundle.\n- Anything the role needs that HQ can't grant (GitHub org seat, SaaS seats,\n  payroll) goes in the report as an action item with an owner — not silently\n  dropped.\n\n### 4. Invite + grants\n\n**Invite** (skip in top-up mode):\n```bash\nhq members invite {email} --company {slug} --role {admin|member}\n```\n- Default path emails the claim link via Resend. With `--no-send-email`, the CLI\n  prints the claim link — surface it ONLY as a Markdown inline link per\n  `core\u002Fpolicies\u002Fhq-secure-link-render-as-markdown.md`; it is a single-use\n  capability.\n\n**Groups**:\n```bash\nhq groups add {group} --member {email} --company {slug}   # or equivalent\n```\n\n**Secrets** — per manifest key:\n```bash\nhq secrets share KEY --company {slug} --with {email} --permission read\n```\n(`--permission` is required; full key path, e.g. `SHOPIFY\u002FCLIENT_ID`, not a\nprefix.)\n\n**File ACLs** — knowledge areas, playbooks, dashboards via `\u002Fhq-files`\ngrants or `\u002Fhq-share` for one-off packets.\n\n### 5. Write the onboarding packet\n\nCreate `companies\u002F{co}\u002Fpeople\u002F{name-slug}\u002Fonboarding.md` in the team vault:\n\n- **Start here**: what the company does, who's who (reporting line, key\n  contacts), which Slack channels to join.\n- **Your access**: the granted bundle in plain language — what each credential\n  or path is for, and the house rules that govern it (link the company's hard\n  policies rather than restating them).\n- **Setup checklist**: `hq login` → `\u002Faccept` (if link not yet claimed) →\n  `hq sync pull --company {co}` → confirm `companies\u002F{co}\u002F` is present →\n  `hq secrets list --company {co}` shows their keys.\n- **First week**: the priorities from Step 2.4.\n\nThe packet syncs to them on their next `hq sync pull --company {co}`. It outlives\nthe welcome message and is the place to update as their access evolves.\n\n### 6. Welcome + follow-through\n\n- Draft the welcome (Slack or `hq dm`): outcome-first, plain language, links to\n  the packet. **Show outbound drafts to the user for approval before sending**\n  — external-facing messages are never fire-and-forget.\n- Track acceptance: invite stays `pending` until they claim it. Check\n  `hq members list --company {co}`; if still pending after a day, resurface to\n  the owner rather than assuming onboarding finished.\n- After acceptance, confirm the setup checklist completed (ask them, or check\n  the signals their function produces — first commit, first report, first\n  message in the team channel).\n\n### 7. Report\n\n```\nHire: {name} \u003C{email}> — {role} @ {co}\n\nInvite:    {sent|pending|already active}\nGroups:    {list}\nGranted:   {n} secrets (read\u002Fwrite split), {m} file paths\nPacket:    companies\u002F{co}\u002Fpeople\u002F{name-slug}\u002Fonboarding.md\nWelcome:   {drafted → approved → sent | awaiting approval}\nOutside HQ: {SaaS seats \u002F org invites needing a human, each with an owner}\n\nDone when: membership active + they confirm the setup checklist.\n```\n\n## Rules\n\n- Least privilege, groups before per-person shares, read before write.\n- Never paste secret values anywhere; grants and `hq secrets exec` only.\n- Claim links are single-use capabilities — markdown inline link render only,\n  never bare tokens.\n- Outbound welcome messages require user approval before sending.\n- Top-up mode (existing member) must diff current access first — never blind\n  re-grant, never re-invite an active member.\n- Tenant isolation: one company per invocation; cross-company access goes\n  through `hq group-grants` with explicit sign-off.\n- Onboarding is not done at invite-send. It is done at membership-active +\n  confirmed setup checklist.\n\n## See also\n\n- `\u002Fnew-agent` — fleet-agent equivalent (adds runtime bootstrap + probe gate)\n- `hq members invite` — the bare invite primitive this skill wraps\n- `\u002Fdesignate-team` — make a company cloud-backed first\n- `\u002Fhq-secrets`, `\u002Fhq-files`, `\u002Fhq-share` — grant primitives\n","# \u002Fnew-hire — Onboard a Human Teammate\n\nOne flow from \"we hired someone\" to \"they have everything their role needs and\nknow where to start.\" The failure mode this skill kills: a new teammate gets an\ninvite email and nothing else — no groups, no secrets, no map of the company —\nand spends their first week asking for access one credential at a time.\n\n**Usage:**\n```\n\u002Fnew-hire                          # interview from scratch\n\u002Fnew-hire {email}                  # onboard a specific person\n\u002Fnew-hire {email} {company}        # skip company resolution\n```\n\nFor **fleet agents** (identities like `agt-…@agents.{your-domain}.ai`), use\n`\u002Fnew-agent` instead — agents need runtime bootstrap and probe verification\nthat humans don't.\n\n## Process\n\n### Who runs these steps\n\nSteps 1–4 are the onboarding admin’s terminal tasks. Run them from a terminal\nwith the HQ CLI signed in to the company account that can invite teammates and\ngrant access. The teammate does not need to run provisioning commands. Their\nsetup is the checklist in Step 5: sign in with `hq login`, accept the invite,\nand pull the company workspace with `hq sync pull --company {co}`.\n\n### 1. Resolve person + company\n\n- Check current state: `hq members list --company {co}`. If the person already\n  has an active membership → **top-up mode**: diff their access against the\n  role's needs and grant only gaps (role changes go through `hq groups` \u002F\n  membership updates, not a re-invite).\n- Company must be in `companies\u002Fmanifest.yaml` and cloud-backed (`cloud_uid`\n  present). Not cloud-backed → route to `\u002Fdesignate-team` first.\n\n### 2. Interview — define the role before the grants\n\nBatched (one AskUserQuestion call, skip anything already known):\n\n1. **Who**: name + email (work email they'll authenticate with).\n2. **Role**: `admin` or `member` in the vault, and their functional role\n   (engineering, finance, ops, design, GTM…) — the function drives the access\n   bundle.\n3. **Access bundle**: which repos, secrets, knowledge areas, and tools does the\n   function need on day one? Prefer naming an existing teammate to mirror\n   (\"same access as X\") — then read X's grants as the template.\n4. **Intro context**: who do they report to, which Slack channels matter, any\n   first-week priorities for the onboarding packet.\n\n### 3. Derive the access bundle\n\nBuild the manifest before granting. For each item, prefer what exists in the\nvault (`hq secrets list --company {co}`) over minting new credentials.\n\n- **Least privilege**: `--permission read` unless their function writes\n  (e.g. an engineer deploying needs write on deploy keys; a finance analyst\n  reading Stripe does not).\n- **Groups first**: if the company uses `hq groups`, add the person to the\n  right group and let group ACLs carry the standing access — per-person shares\n  are for exceptions, not the baseline.\n- **Payment\u002Fproduction keys**: verify scope before sharing (a Stripe key's\n  prefix — `rk_` restricted vs `sk_` full — can be checked without exposure via\n  `hq secrets exec --company {co} --only KEY -- sh -c 'printf %s \"$KEY\" | cut -c1-3'`).\n  Flag full-scope keys to the owner before including them in an onboarding\n  bundle.\n- Anything the role needs that HQ can't grant (GitHub org seat, SaaS seats,\n  payroll) goes in the report as an action item with an owner — not silently\n  dropped.\n\n### 4. Invite + grants\n\n**Invite** (skip in top-up mode):\n```bash\nhq members invite {email} --company {slug} --role {admin|member}\n```\n- Default path emails the claim link via Resend. With `--no-send-email`, the CLI\n  prints the claim link — surface it ONLY as a Markdown inline link per\n  `core\u002Fpolicies\u002Fhq-secure-link-render-as-markdown.md`; it is a single-use\n  capability.\n\n**Groups**:\n```bash\nhq groups add {group} --member {email} --company {slug}   # or equivalent\n```\n\n**Secrets** — per manifest key:\n```bash\nhq secrets share KEY --company {slug} --with {email} --permission read\n```\n(`--permission` is required; full key path, e.g. `SHOPIFY\u002FCLIENT_ID`, not a\nprefix.)\n\n**File ACLs** — knowledge areas, playbooks, dashboards via `\u002Fhq-files`\ngrants or `\u002Fhq-share` for one-off packets.\n\n### 5. Write the onboarding packet\n\nCreate `companies\u002F{co}\u002Fpeople\u002F{name-slug}\u002Fonboarding.md` in the team vault:\n\n- **Start here**: what the company does, who's who (reporting line, key\n  contacts), which Slack channels to join.\n- **Your access**: the granted bundle in plain language — what each credential\n  or path is for, and the house rules that govern it (link the company's hard\n  policies rather than restating them).\n- **Setup checklist**: `hq login` → `\u002Faccept` (if link not yet claimed) →\n  `hq sync pull --company {co}` → confirm `companies\u002F{co}\u002F` is present →\n  `hq secrets list --company {co}` shows their keys.\n- **First week**: the priorities from Step 2.4.\n\nThe packet syncs to them on their next `hq sync pull --company {co}`. It outlives\nthe welcome message and is the place to update as their access evolves.\n\n### 6. Welcome + follow-through\n\n- Draft the welcome (Slack or `hq dm`): outcome-first, plain language, links to\n  the packet. **Show outbound drafts to the user for approval before sending**\n  — external-facing messages are never fire-and-forget.\n- Track acceptance: invite stays `pending` until they claim it. Check\n  `hq members list --company {co}`; if still pending after a day, resurface to\n  the owner rather than assuming onboarding finished.\n- After acceptance, confirm the setup checklist completed (ask them, or check\n  the signals their function produces — first commit, first report, first\n  message in the team channel).\n\n### 7. Report\n\n```\nHire: {name} \u003C{email}> — {role} @ {co}\n\nInvite:    {sent|pending|already active}\nGroups:    {list}\nGranted:   {n} secrets (read\u002Fwrite split), {m} file paths\nPacket:    companies\u002F{co}\u002Fpeople\u002F{name-slug}\u002Fonboarding.md\nWelcome:   {drafted → approved → sent | awaiting approval}\nOutside HQ: {SaaS seats \u002F org invites needing a human, each with an owner}\n\nDone when: membership active + they confirm the setup checklist.\n```\n\n## Rules\n\n- Least privilege, groups before per-person shares, read before write.\n- Never paste secret values anywhere; grants and `hq secrets exec` only.\n- Claim links are single-use capabilities — markdown inline link render only,\n  never bare tokens.\n- Outbound welcome messages require user approval before sending.\n- Top-up mode (existing member) must diff current access first — never blind\n  re-grant, never re-invite an active member.\n- Tenant isolation: one company per invocation; cross-company access goes\n  through `hq group-grants` with explicit sign-off.\n- Onboarding is not done at invite-send. It is done at membership-active +\n  confirmed setup checklist.\n\n## See also\n\n- `\u002Fnew-agent` — fleet-agent equivalent (adds runtime bootstrap + probe gate)\n- `hq members invite` — the bare invite primitive this skill wraps\n- `\u002Fdesignate-team` — make a company cloud-backed first\n- `\u002Fhq-secrets`, `\u002Fhq-files`, `\u002Fhq-share` — grant primitives\n",{"name":5,"description":7,"allowed-tools":48},"Bash, Read, Write, AskUserQuestion","main","205cf61728a27ef15e9153aa38df5856fc8d82f5",".claude\u002Fskills\u002Fnew-hire",18,"https:\u002F\u002Fgithub.com\u002Findigoai-us\u002Fhq-core","https:\u002F\u002Fgithub.com\u002Findigoai-us","https:\u002F\u002Fhqforwork.com\u002F","The AI Context Layer for Teams","2026-11-09 23:36:37",{"source":8,"skillName":5,"commands":59,"prompt":69,"zipAvailable":70},[60,63,66],{"tool":61,"command":62},"npx","npx skills add indigoai-us\u002Fhq-core --skill new-hire",{"tool":64,"command":65},"bunx","bunx skills add indigoai-us\u002Fhq-core --skill new-hire",{"tool":67,"command":68},"pnpm","pnpm dlx skills add indigoai-us\u002Fhq-core --skill new-hire","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Findigoai-us\u002Fhq-core\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fnew-hire\u002FSKILL.md",true,[72],{"path":73,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":76,"sourceHtmlUrl":77},"agents\u002Fopenai.yaml","REFERENCE","参考文档",124,"https:\u002F\u002Fgithub.com\u002Findigoai-us\u002Fhq-core\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fnew-hire\u002Fagents\u002Fopenai.yaml",[79,98,128,152,163,173],{"skillNo":80,"name":81,"nameZh":6,"description":82,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":83,"categories":84,"keywords":85,"publishedAt":43},"01M71E4MQ04WPK1EVDS7VKJ3E8","social-graphic","Generate 1080x1080 HTML social graphics for HQ update posts.","https:\u002F\u002Fgithub.com\u002Findigoai-us\u002Fhq-core\u002Fblob\u002Fmain\u002Fcore\u002Fworkers\u002Fpublic\u002Fsocial-strategist\u002Fskills\u002Fsocial-graphic\u002FSKILL.md",[],[86,87,37,88,89,30,33,90,91,92,93,94,95,96,97],"social","social graphic","html","edit","update","generate","graphics","browser","open","agent-browser","for","posts",{"skillNo":99,"name":95,"nameZh":6,"description":100,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":101,"categories":102,"keywords":111,"publishedAt":43},"01M71E4H33K4P5H5M7ENPTMFSC","Browser automation CLI for AI agents. Use when the user needs to interact with websites, including navigating pages, filling forms, clicking buttons, taking screenshots, extracting data, testing web apps, or automating any browser task. Triggers include requests to \"open a website\", \"fill out a form\", \"click a button\", \"take a screenshot\", \"scrape data from a page\", \"test this web app\", \"login to a site\", \"automate browser actions\", or any task requiring programmatic web interaction.","https:\u002F\u002Fgithub.com\u002Findigoai-us\u002Fhq-core\u002Fblob\u002Fmain\u002Fcore\u002Fworkers\u002Fpublic\u002Fqa-tester\u002Fskills\u002Fagent-browser\u002FSKILL.md",[103,108],{"categoryNo":104,"categoryName":105,"taxonomyType":106,"taxonomyTypeDesc":107},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":109,"categoryName":110,"taxonomyType":106,"taxonomyTypeDesc":107},"01JBSEEDCAT000000000000023","Skill与智能体开发",[112,93,113,114,115,116,37,117,118,119,120,121,94,122,95,123,124,125,126,127],"agent browser","click","ai agents","app","scrape","when","apps","actions","extracting","take a screenshot","testing","programmatic","browser automation","website","cli","interaction",{"skillNo":129,"name":130,"nameZh":6,"description":131,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":132,"categories":133,"keywords":134,"publishedAt":43},"01M71E4FDBD7J8Y45JJ9KMMYGN","work-mesh","Work Mesh Live — automatic presence via hq mesh daemon; context reconcile\u002Forganize; manual session task-status, blocked, and note only.","https:\u002F\u002Fgithub.com\u002Findigoai-us\u002Fhq-core\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fwork-mesh\u002FSKILL.md",[],[135,136,137,37,138,139,140,141,142,143,144,145,146,147,33,148,149,150,151],"work mesh","work","mesh","status","context","note","live","presence","automatic","reconcile","only","organize","task","session","manual","daemon","via",{"skillNo":153,"name":154,"nameZh":6,"description":155,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":156,"categories":157,"keywords":158,"publishedAt":43},"01M71E4EGHNAAGWAPV6KGBMQ9W","review","Parity worker review skill (materialization fixture).","https:\u002F\u002Fgithub.com\u002Findigoai-us\u002Fhq-core\u002Fblob\u002Fmain\u002Fcore\u002Fscripts\u002Ftests\u002Ffixtures\u002Fagent-session\u002Fworker-materialization\u002Fparity-worker\u002Fskills\u002Freview\u002FSKILL.md",[],[154,159,160,161,162],"review skill","fixture","parity","worker",{"skillNo":164,"name":165,"nameZh":6,"description":166,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":167,"categories":168,"keywords":169,"publishedAt":43},"01M71E4D1FZDJPDC15DRERKX8Y","run","Run or list HQ workers (parity fixture).","https:\u002F\u002Fgithub.com\u002Findigoai-us\u002Fhq-core\u002Fblob\u002Fmain\u002Fcore\u002Fscripts\u002Ftests\u002Ffixtures\u002Fagent-session\u002Fskills\u002Frun\u002FSKILL.md",[],[165,170,171,161,172,160],"parity fixture","workers","list",{"skillNo":174,"name":175,"nameZh":6,"description":176,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":177,"categories":178,"keywords":179,"publishedAt":43},"01M71E4BF4MV5SEWZJZ4T1QPQW","handoff","Preserve session state for a follow-up agent (parity fixture).","https:\u002F\u002Fgithub.com\u002Findigoai-us\u002Fhq-core\u002Fblob\u002Fmain\u002Fcore\u002Fscripts\u002Ftests\u002Ffixtures\u002Fagent-session\u002Fskills\u002Fhandoff\u002FSKILL.md",[],[175,170,40,180,148,181,96,161,182,183,160],"preserve","session state","follow-up","state"]