Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Zfinix/aster --skill aster-capabilitiesgit clone --depth 1 https://github.com/Zfinix/asterWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/zfinix/aster/aster-capabilities)<a href="https://agentmods.dev/skills/zfinix/aster/aster-capabilities"><img src="https://agentmods.dev/badge/skills/zfinix/aster/aster-capabilities.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.04775 |
| Opus 5 | $0.00000 | $0.02388 |
| Sonnet 5 | $0.00000 | $0.00955 |
| Haiku 4.5 | $0.00000 | $0.00477 |
Grade C, and why
aster-capabilities scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl -fsSL https://withaster.dev/install | sh # binary install Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -fsSL https://withaster.dev/install | sh # binary install How it starts
The opening of the file, as written. The whole thing — 345 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Everything Aster can do
Aster is a self-hostable agent harness for software work: one aster binary that chats, edits, runs commands, reviews diffs, remembers, and runs on a schedule, in a terminal, a browser, VS Code, Zed, or a desktop window. Every subcommand takes --json (before or after it) and turns errors into {"ok":false,"error":…}. Every command that runs a model takes --model and --effort off|low|medium|high|xhigh|max|ultra.
When a question is "can Aster do X", find X below and answer with the command. When unsure whether a flag still exists, run aster <cmd> --help; it is the source of truth.
Install, upgrade, sign in
curl -fsSL https://withaster.dev/install | sh # binary install
cargo install --path crates/aster-cli # from source, Rust 1.85+
aster upgrade # swap in the latest release
aster upgrade --version 0.4.0 --force # pin or reinstall
aster init # wizard: provider + key into ~/.aster
aster init --local # config in this repo instead
aster init --yes --force # default aster.yaml, no questions
aster login # GitHub (for --pr and --comment)
aster login codex | openrouter | zai # provider sign-in via browser
aster logout # drop every stored login
aster status # what the next turn runs with
aster announce [--dismiss id,id] # undismissed release notes as JSON
Config lives in ./aster.yaml (repo) merged over ~/.aster/aster.yaml; keys live in .env files, never in yaml. Precedence: CLI flags > env > aster.yaml > defaults.
Chat
aster # TUI in the current repo
aster "why does the build fail?" # one-shot, prints and exits (--print / -p)
echo "explain this repo" | aster # piped stdin is the prompt
aster --continue # resume this repo's latest session
aster --resume [ID] # pick a session, or resume one by id
aster --session ID "next question" # persist into a named session
aster --messages-json history.json # caller owns the transcript (- for stdin)
aster --compact --messages-json h.json # fold history into a summary, print it
aster --stream # NDJSON events out, approval replies in
aster --no-tools # plain chat, no read/search/edit
aster --no-mcp # start instantly; /mcp connects later
aster --allow-edits # let a scripted turn edit files
aster --permission-mode plan|manual|auto|edit|yolo
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 345 lines · 0 tokens per session scan C 53a321362aca
aster-capabilities is a skill published in the GitHub repository Zfinix/aster (57 stars, last pushed today), licensed Apache-2.0. It costs nothing until one of its globs matches a file; then it loads 4,775 tokens. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-06.
Other skills, from other repositories
Cortex
Operate Cortex, the LifeOS memory system — the typed Knowledge Archive (People, Companies, Ideas, Research with typed related: links) plus recall of prior work sessions, ISAs, and conversations. Search, add, harvest, develop, ingest, distill, graph-navigate, recall. USE WHEN cortex, knowledge, knowledge base, search…
Research
Multi-agent web research with mandatory URL verification, confidence-tagged output, and four depth modes (quick to deep investigation). USE WHEN research, do research, quick research, extensive research, deep investigation, find information, investigate, extract alpha, analyze content, retrieve content, AI trends…
ExtractWisdom
Content-adaptive wisdom extraction that reads content first, detects which wisdom domains are present, and builds custom sections around them, with five depth levels and mandatory contrarian takes; pulls YouTube via fabric and articles via WebFetch. USE WHEN extract wisdom, analyze video, analyze podcast, extract…
LocalIntelligence
Generic civic intelligence aggregator for any US city — daily local digest of construction permits, crime, new businesses, public officials, legislation, elections, arrests, and local news, keyed off principal's Hometown. Writes JSON consumed by Pulse LOCAL tab. Crime delegates to a dedicated crime-stats skill.…
RootCauseAnalysis
Structured incident investigation using Five Whys, Fishbone, blameless Postmortem, Fault Tree, Kepner-Tregoe, and FMEA — traces failures to systemic root causes rather than blaming humans. USE WHEN root cause, RCA, 5 whys, fishbone, postmortem, incident analysis, fault tree, why does this keep failing, blameless…
ApertureOscillation
3-pass scope oscillation that holds a question constant while shifting zoom — narrow/tactical, wide/strategic, then synthesis — to surface design tensions, scope recommendations, and coherence assessments invisible at any single zoom level. USE WHEN aperture oscillation, oscillate scope, zoom in and out, tactical vs…