Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Zfinix/aster --skill aster-capabilitiesgit clone --depth 1 https://github.com/Zfinix/asterWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/zfinix/aster/aster-capabilities)<a href="https://agentmods.dev/skills/zfinix/aster/aster-capabilities"><img src="https://agentmods.dev/badge/skills/zfinix/aster/aster-capabilities/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/zfinix/aster/aster-capabilities"><img src="https://agentmods.dev/badge/skills/zfinix/aster/aster-capabilities.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.04842 |
| Opus 5.5 | $0.00000 | $0.01937 |
| Sonnet 5.5 | $0.00000 | $0.00968 |
| Haiku 4.5 | $0.00000 | $0.00484 |
Grade C, and why
aster-capabilities scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 18d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl -fsSL https://withaster.dev/install | sh # binary install Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -fsSL https://withaster.dev/install | sh # binary install How it starts
The opening of the file, as written. The whole thing — 346 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Everything Aster can do
Aster is a self-hostable agent harness for software work: one aster binary that chats, edits, runs commands, reviews diffs, remembers, and runs on a schedule, in a terminal, a browser, VS Code, Zed, or a desktop window. Every subcommand takes --json (before or after it) and turns errors into {"ok":false,"error":…}. Every command that runs a model takes --model and --effort off|low|medium|high|xhigh|max|ultra.
When a question is "can Aster do X", find X below and answer with the command. When unsure whether a flag still exists, run aster <cmd> --help; it is the source of truth.
Install, upgrade, sign in
curl -fsSL https://withaster.dev/install | sh # binary install
cargo install --path crates/aster-cli # from source, Rust 1.85+
aster upgrade # swap in the latest release
aster upgrade --version 0.4.0 --force # pin or reinstall
aster init # wizard: provider + key into ~/.aster
aster init --local # config in this repo instead
aster init --yes --force # default aster.yaml, no questions
aster login # GitHub (for --pr and --comment)
aster login codex | openrouter | zai # provider sign-in via browser
aster logout # drop every stored login
aster status # what the next turn runs with
aster announce [--dismiss id,id] # undismissed release notes as JSON
Config lives in ./aster.yaml (repo) merged over ~/.aster/aster.yaml; keys live in .env files, never in yaml. Precedence: CLI flags > env > aster.yaml > defaults.
Chat
aster # TUI in the current repo
aster "why does the build fail?" # one-shot, prints and exits (--print / -p)
echo "explain this repo" | aster # piped stdin is the prompt
aster --continue # resume this repo's latest session
aster --resume [ID] # pick a session, or resume one by id
aster --session ID "next question" # persist into a named session
aster --messages-json history.json # caller owns the transcript (- for stdin)
aster --compact --messages-json h.json # fold history into a summary, print it
aster --stream # NDJSON events out, approval replies in
aster --no-tools # plain chat, no read/search/edit
aster --no-mcp # start instantly; /mcp connects later
aster --allow-edits # let a scripted turn edit files
aster --permission-mode plan|manual|auto|edit|yolo
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 18d ago Changed · +1 lines ae2630e478b9
- 1mo ago Changed a5f06a449da4
- 1mo ago Changed bda9ee1bc9bd
- 1mo ago First seen · 345 lines · 0 tokens per session scan C 53a321362aca
aster-capabilities is a skill published in the GitHub repository Zfinix/aster (132 stars, last pushed today), licensed Apache-2.0. It costs nothing until one of its globs matches a file; then it loads 4,842 tokens. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-06.
Other skills, from other repositories
batch-api
Prepare a many-file, single-turn transform (translate, rewrite, extract) as a plan and submit it to the asynchronous, half-price DashScope Batch API; results are delivered as new files hours later. Invoke explicitly with /batch-api.
hand-off
Get work done that needs another person's own logins, files or memory. Decide whether to just do it yourself, and if not, ask that person by DM with the full request.
Interceptor
Real Chrome/Brave + macOS Computer Use from inside the browser — zero CDP fingerprint, real sessions; mandatory for visual deploy verification. Drive clickwork yourself. USE WHEN verify deploy, confirm UI, screenshot verification, computer use, macos automation, debug web, troubleshoot, visual check, motion/animation…
Cortex
Operate Cortex, the LifeOS memory system — the typed Knowledge Archive (People, Companies, Ideas, Research with typed related: links) plus recall of prior work sessions, ISAs, and conversations. Search, add, harvest, develop, ingest, distill, graph-navigate, recall. USE WHEN cortex, knowledge, knowledge base, search…
Research
Multi-agent web research with mandatory URL verification, confidence-tagged output, and four depth modes (quick to deep investigation). USE WHEN research, do research, quick research, extensive research, deep investigation, find information, investigate, extract alpha, analyze content, retrieve content, AI trends…
LocalIntelligence
Generic civic intelligence aggregator for any US city — daily local digest of construction permits, crime, new businesses, public officials, legislation, elections, arrests, and local news, keyed off principal's Hometown. Writes JSON consumed by Pulse LOCAL tab. Crime delegates to a dedicated crime-stats skill.…