Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/aspenkit/aspens/codex-supportnpx skills add aspenkit/aspens --skill codex-supportgit clone --depth 1 https://github.com/aspenkit/aspensWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00024 | $0.01783 |
| Opus 5 | $0.00012 | $0.00892 |
| Sonnet 5 | $0.00005 | $0.00357 |
| Haiku 4.5 | $0.00002 | $0.00178 |
Grade A, and why
codex-support scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 64 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are working on multi-target output support — the system that lets aspens generate documentation for Claude Code, Codex CLI, or both simultaneously.
Key Concepts
- Target vs Backend: Target = where output goes (claude →
.claude/skills/, codex →.agents/skills/+ directory-scopedAGENTS.md). Backend = which LLM CLI generates the content (claude -porcodex exec). - Target definitions:
TARGETS.claude(centralized) andTARGETS.codex(directory-scoped). Each defines paths and capability flags:supportsHooks,supportsSettings,supportsGraph,supportsSkills,needsActivationSection,needsCodeMapEmbed,supportsMCP. Codex also hasmaxInstructionsBytes(32 KiB) anduserSkillsDir. Codex'sneedsCodeMapEmbedisfalse— condensed cluster/framework data goes into the synthetic.agents/skills/architecture/skill instead of the root AGENTS.md. - Canonical generation: Generation always produces Claude-canonical format first. Prompts always receive
CANONICAL_VARS(hardcoded Claude paths fromdoc-init.js). Transforms run after generation to produce other target formats. - Content transform:
transformForTarget()remaps paths and content. For Codex: base skill → rootAGENTS.md, domain skills → both.agents/skills/{domain}/SKILL.mdand source directoryAGENTS.md.generateCodexSkillReferences()creates.agents/skills/architecture/with code-map data. - Skills section completeness:
collectSkillsForList()(internal) reads every skill from disk undersourceTarget.skillsDirand overlays pending in-flight changes (filespassed to the transform) so the root instructions file's## Skillssection always lists every on-disk skill — not just the subset that changed in this sync. Pending changes win for descriptions; on-disk content survives for unchanged skills. - Instructions file disk fallback:
transformToDirectoryScopedloadsinstructionsFilefrom disk viarepoPathcontext parameter when it's not in the canonical files array (e.g., duringdoc init --strategy skip-existingor incrementaldoc sync). Uses a singlereadFileSyncfromfswrapped in try/catch (no separateexistsSynccheck). - Content sanitization:
sanitizeCodexInstructions()andsanitizeCodexSkill()strip Claude-specific references (hooks, skill-rules.json, Claude Code mentions) from Codex output. sanitizePublishedContent(content, filePath)— Single-chokepoint sanitizer invoked byskill-writer.json every disk write. Always strips## Activationblocks and## Key Filesblocks. Outsidecode-map.md, also strips count-bearing blocks:**Hub files…**,**Domain clusters:**,**High-churn hotspots:**,**Framework entry points…**. Defense in depth — upstream leaks can't reach the user.- Skills-variant stripping:
syncSkillsSection()removes LLM-emitted Skill-section variants (## Skills Reference,## Skills Overview, etc.) before injecting the canonical## Skillslist. Doc-init and doc-sync prompts also forbid such headings. ensureRootKeyFilesSection(content, graphSerialized)— Post-processes root instructions file to guarantee a## Key Filessection with top hub files from the graph.mergeConfiguredTargets(existing, next)— Merges target arrays to avoid dropping previously configured targets during narrower runs. Validates againstTARGETSkeys, deduplicates.getAllowedPaths(targets)— Returns{ dirPrefixes, exactFiles }union across all active targets.- Backend detection:
detectAvailableBackends()checks ifclaudeandcodexCLIs are installed.resolveBackend()picks best match: explicit flag > target match > fallback. - Config persistence:
.aspens.jsonat repo root stores{ targets, backend, version, saveTokens? }.readConfig()returnsnullif missing or if the config is structurally invalid.isValidConfig()validates targets, backend, version, andsaveTokens(viaisValidSaveTokensConfig()). loadConfig(repoPath, { persist })— Reads.aspens.jsonand, if missing, recovers viainferConfig()from on-disk artifacts. Returns{ config, recovered }. Persists inferred config to disk by default unlesspersist: falseis passed.- Feature config (
saveTokens): Optional object in.aspens.jsonvalidated byisValidSaveTokensConfig()— checksenabled(boolean),warnAtTokens/compactAtTokens(positive integers, compact > warn unless either isMAX_SAFE_INTEGER),saveHandoff/sessionRotation(booleans), optionalclaude/codexsub-objects withenabledandmode. writeConfigpreserves feature config:writeConfig()reads existing config and merges —saveTokenspreserved unless explicitly set tonull(intentional removal) orundefined(keep existing). Targets and backend also merge with existing.- Multi-target publish:
doc-syncusespublishFilesForTargets()to generate output for all configured targets from a single LLM run.repoPathis passed through to the transform context. - Codex inference tightened:
inferConfig()only adds'codex'to inferred targets when.codex/config dir or.agents/skills/dir exists. - Conditional architecture ref: Codex
buildCodexSkillRefs()only includes the architecture skill reference when a graph was actually serialized. - Architecture skill is codex-only synthetic: The codex
architectureskill is generated from graph data and has no Claude counterpart by design.logicalKeyForFile()returnsnullfor codexarchitecturepaths soassertTargetParity()won't raise a parity violation for the missing Claude side.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 64 lines · 24 tokens per session scan A 6a907b4fb9c3
codex-support is a skill published in the GitHub repository aspenkit/aspens (96 stars, last pushed 16d ago), licensed MIT. It adds 24 tokens to every session and 1,783 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
golden-rss
Use when testing the rss golden build.
golden-chat-topics
Use when testing the goldenchattopics golden build.
golden-chat-single
Use when testing the goldenchatsingle golden build.
decided-import
Reformat ONE existing document (a decision, requirement, design, roadmap, or prompt) into ONE valid RAC (requirements-as-code) artifact, with a mandatory human-review step before any file is written and decided validate as the deterministic close. Use when a user wants to add or import a single existing decision or…
keep-the-why
Preserves or recovers the reasoning behind a codebase - architectural decisions, rejected alternatives, workarounds, incident learnings, operational constraints, and historical context the code itself cannot explain. Use when implementing or reviewing a non-trivial change involving a design decision, workaround…
summarize
Summarize conversations, logs, docs, or investigation notes into action-oriented text with evidence tags. Use for recap, handoff, CI failure digest, or MEMORY. Triggers: 总结, 汇总, summarize, 交接, 复盘, 调试总结.