Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/aspenkit/aspens/agent-customizationnpx skills add aspenkit/aspens --skill agent-customizationgit clone --depth 1 https://github.com/aspenkit/aspensWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00022 | $0.00851 |
| Opus 5 | $0.00011 | $0.00426 |
| Sonnet 5 | $0.00004 | $0.00170 |
| Haiku 4.5 | $0.00002 | $0.00085 |
Grade A, and why
agent-customization scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 47 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are working on agent customization — the feature that reads a project's skills and AGENTS.md, then uses Claude CLI to inject project-specific context into generic agent files in .claude/agents/.
Domain purpose
aspens customize agents makes generic, bundled agent templates project-aware. It pulls the repo's skills + AGENTS.md as ground truth and asks Claude to add a tech-stack line, 3-5 project conventions, and real commands into each agent — without touching the agent's core logic.
Business rules / invariants
- Claude-only feature. Throws
CliErrorfor Codex-only repos (config.targets === ['codex']). Codex CLI has no agent concept. - Base skill is required. Pre-flight throws
CliError("Run 'aspens doc init' first — base skill is required for agent context.")if.agents/skills/base/SKILL.mdis missing. - Skills (
.claude/skills/**) are the single source of truth for project context. The prompt must not invent other context directories. - Read-only tools only. Claude is invoked with
allowedTools: ['Read', 'Glob', 'Grep']— no edits/writes from the LLM itself. - Output paths restricted to
.claude/.parseFileOutput()rejects anything else;writeSkillFiles(..., { force: true })does the actual write.
Non-obvious behaviors
- Frontmatter preservation is split across LLM + code. The prompt instructs Claude to preserve YAML frontmatter verbatim (including NOT adding a
skills:line). ThenmaybeInjectBaseSkill()post-processes each returned file to addskills: [base]into the frontmatter — this keeps agents valid even when installed viaaspens add agentwithout a priordoc init. --resetsemantics: without--reset, agents that already declareskills:are left alone; with--reset, any existingskills:line is overwritten toskills: [base]. Used to roll out v0.8 upgrades to previously-customized agents.## Project contextblock is verbatim-preserved by the prompt — it carries conditional read instructions for code-map / domain skills.- AGENTS.md is truncated at 3000 chars in
gatherProjectContext(); skills are passed in full. - Agent discovery:
findAgents()recursively walks.claude/agents/, extractsname:via regex, falls back to filename if missing. - Default timeout 300s via
resolveTimeout(options.timeout, 300);ASPENS_TIMEOUTenv var honored with warning on invalid value.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 47 lines · 22 tokens per session scan A 1a2600d50da9
agent-customization is a skill published in the GitHub repository aspenkit/aspens (96 stars, last pushed 17d ago), licensed MIT. It adds 22 tokens to every session and 851 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
golden-rss
Use when testing the rss golden build.
golden-chat-topics
Use when testing the goldenchattopics golden build.
golden-chat-single
Use when testing the goldenchatsingle golden build.
decided-import
Reformat ONE existing document (a decision, requirement, design, roadmap, or prompt) into ONE valid RAC (requirements-as-code) artifact, with a mandatory human-review step before any file is written and decided validate as the deterministic close. Use when a user wants to add or import a single existing decision or…
keep-the-why
Preserves or recovers the reasoning behind a codebase - architectural decisions, rejected alternatives, workarounds, incident learnings, operational constraints, and historical context the code itself cannot explain. Use when implementing or reviewing a non-trivial change involving a design decision, workaround…
summarize
Summarize conversations, logs, docs, or investigation notes into action-oriented text with evidence tags. Use for recap, handoff, CI failure digest, or MEMORY. Triggers: 总结, 汇总, summarize, 交接, 复盘, 调试总结.