Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Zfinix/aster --skill aster-cligit clone --depth 1 https://github.com/Zfinix/asterWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/zfinix/aster/aster-cli)<a href="https://agentmods.dev/skills/zfinix/aster/aster-cli"><img src="https://agentmods.dev/badge/skills/zfinix/aster/aster-cli/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/zfinix/aster/aster-cli"><img src="https://agentmods.dev/badge/skills/zfinix/aster/aster-cli.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Output Handling · line 3 Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.Fix: Validate and sanitize all model output before using it in downstream contexts. Use parameterized queries for SQL, shell quoting for commands, and HTML encoding for web output.
- medium Excessive Agency · line 68 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium Excessive Agency · line 94 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.01133 |
| Opus 5.5 | $0.00000 | $0.00453 |
| Sonnet 5.5 | $0.00000 | $0.00227 |
| Haiku 4.5 | $0.00000 | $0.00113 |
Grade A, and why
aster-cli scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 106 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Aster CLI
Aster is an AI coding agent that works in your repository: it reads and searches the code, answers questions, applies edits, and runs a review pipeline that forms hypotheses about defects, verifies them against the codebase, and reports shaped findings. It runs locally against the current repo and needs an aster.yaml (created by aster init).
Setup
aster init # pick a provider, write aster.yaml, store the API key
aster login # optional: link GitHub via device flow (needed for PR reviews)
aster init is interactive. Run it once per repo; keys are stored outside the repo so aster.yaml is safe to commit.
Reviewing code
aster review # review the current branch against its base
aster review main..HEAD # review an explicit range
aster review path/to/file.rs # review a single file
aster review --pr 123 # review a GitHub PR (requires aster login)
Review output is a list of findings. Prefer reviewing the smallest meaningful diff: a branch or range, not the whole repo.
Chat and fixes
aster chat # interactive TUI with the review agent
aster chat --print "question" # one-shot answer to stdout (use this from scripts and agents)
aster fix # apply model-generated fixes for findings (dry-run by default)
As an agent, always use aster chat --print rather than the TUI. aster fix never writes without an explicit apply flag; run it plain first and inspect the dry-run output.
Sessions and memory
aster sessions # list saved chat sessions for this repo
aster sessions show <id> # print a session's full transcript
aster memory # list stored durable memory
aster memory add "fact" # append a fact to project memory
aster memory add --title t "…" # save a titled memory block
Both accept --json; see below.
Skills
Aster loads agent skills from .aster/skills (project) and <config>/aster/skills (user-global).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 106 lines · 0 tokens per session scan A 54a1a54c4cf3
aster-cli is a skill published in the GitHub repository Zfinix/aster (129 stars, last pushed 8d ago), licensed Apache-2.0. It costs nothing until one of its globs matches a file; then it loads 1,133 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
speccrew-knowledge-bizs-identify-entries
Analyze source directory structures to identify business module entry directories for each platform using XML workflow blocks. Use when initializing or updating business knowledge base to determine which directories contain user-facing entry points.
speccrew-knowledge-techs-generate
Stage 2 of technology knowledge initialization - Generate technology documentation for a specific platform using XML workflow blocks. Extracts tech stack, architecture, and conventions from configuration files and source code. Creates INDEX.md, tech-stack.md, architecture.md, and conventions-.md files. Used by Worker…
speccrew-knowledge-techs-index
Stage 3 of technology knowledge initialization - Generate root INDEX.md by aggregating all platform technology documents using XML workflow blocks. Creates the master index that maps platforms to their documentation and provides Agent-to-Platform mapping guide. Used by Worker Agent after all platform documents are…
speccrew-knowledge-techs-init
Stage 1 of technology knowledge initialization - Scan source code to detect technology platforms and generate techs-manifest.json using XML workflow blocks. Identifies web, mobile, backend, and desktop platforms by analyzing configuration files and project structure. Used by Worker Agent to kick off the techs pipeline.
speccrew-knowledge-bizs-dispatch
Dispatch bizs knowledge base generation tasks with 5-stage pipeline (XML Block version). Handles feature inventory, feature analysis with skill routing, graph data writing, module summarization, UI style pattern extraction, and system summary.
speccrew-knowledge-bizs-ui-graph
Constructs knowledge graph data (nodes, edges, relationships) from UI analysis results using XML workflow blocks. Generates graph JSON files and completion markers for the bizs knowledge pipeline.