Install
$ agentstack add skill-aspenkit-aspens-agent-customization ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
You are working on agent customization — the feature that reads a project's skills and CLAUDE.md, then uses Claude CLI to inject project-specific context into generic agent files in .claude/agents/.
Domain purpose
aspens customize agents makes generic, bundled agent templates project-aware. It pulls the repo's skills + CLAUDE.md as ground truth and asks Claude to add a tech-stack line, 3-5 project conventions, and real commands into each agent — without touching the agent's core logic.
Business rules / invariants
- Claude-only feature. Throws
CliErrorfor Codex-only repos (config.targets === ['codex']). Codex CLI has no agent concept. - Base skill is required. Pre-flight throws
CliError("Run 'aspens doc init' first — base skill is required for agent context.")if.claude/skills/base/skill.mdis missing. - Skills (
.claude/skills/**) are the single source of truth for project context. The prompt must not invent other context directories. - Read-only tools only. Claude is invoked with
allowedTools: ['Read', 'Glob', 'Grep']— no edits/writes from the LLM itself. - Output paths restricted to
.claude/.parseFileOutput()rejects anything else;writeSkillFiles(..., { force: true })does the actual write.
Non-obvious behaviors
- Frontmatter preservation is split across LLM + code. The prompt instructs Claude to preserve YAML frontmatter verbatim (including NOT adding a
skills:line). ThenmaybeInjectBaseSkill()post-processes each returned file to addskills: [base]into the frontmatter — this keeps agents valid even when installed viaaspens add agentwithout a priordoc init. --resetsemantics: without--reset, agents that already declareskills:are left alone; with--reset, any existingskills:line is overwritten toskills: [base]. Used to roll out v0.8 upgrades to previously-customized agents.## Project contextblock is verbatim-preserved by the prompt — it carries conditional read instructions for code-map / domain skills.- CLAUDE.md is truncated at 3000 chars in
gatherProjectContext(); skills are passed in full. - Agent discovery:
findAgents()recursively walks.claude/agents/, extractsname:via regex, falls back to filename if missing. - Default timeout 300s via
resolveTimeout(options.timeout, 300);ASPENS_TIMEOUTenv var honored with warning on invalid value.
Critical files (purpose, not inventory)
src/commands/customize.js— orchestrator: preflight, agent discovery, context gathering, per-agent Claude calls, post-LLMskills: [base]injection, write.src/prompts/customize-agents.md— system prompt; enforces frontmatter +## Project contextpreservation and bans file-inventory / hub-ranking output.
Critical Rules
- Never let the LLM emit a
skills:line — the prompt forbids it and the code adds it. If you change one, change both. - Never weaken path sanitization — only
.claude/paths may be written. - Never duplicate file-inventory or hub-ranking output in customized agents — the graph hook supplies that dynamically.
- Do not bypass the base-skill preflight — agents without base context regress to generic behavior.
Last Updated: 2026-05-11
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: aspenkit
- Source: aspenkit/aspens
- License: MIT
- Homepage: https://www.npmjs.com/package/aspens
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.