Borrowing it
Nothing to install: this file belongs to Kewton/CommandMate. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/Kewton/CommandMate/main/.claude/skills/catalog-reconcile/SKILL.mdgit clone --depth 1 https://github.com/Kewton/CommandMateWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kewton/commandmate/catalog-reconcile)<a href="https://agentmods.dev/skills/kewton/commandmate/catalog-reconcile"><img src="https://agentmods.dev/badge/skills/kewton/commandmate/catalog-reconcile/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kewton/commandmate/catalog-reconcile"><img src="https://agentmods.dev/badge/skills/kewton/commandmate/catalog-reconcile.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 4 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 510 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 607 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 584 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 598 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00062 | $0.12788 |
| Opus 5.5 | $0.00025 | $0.05115 |
| Sonnet 5.5 | $0.00012 | $0.02558 |
| Haiku 4.5 | $0.00006 | $0.01279 |
Grade A, and why
catalog-reconcile scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 23d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -sS "https://raw.githubusercontent.com/openai/codex/${TAG}/codex-rs/tui/src/slash_command.rs" \ How it starts
The opening of the file, as written. The whole thing — 712 lines — stays where its author put it; the contents beside it link to each section on GitHub.
スラッシュコマンドカタログ リコンサイル スキル
src/config/slash-commands-catalog.json と locales/{en,ja}/worktree.json を、
各 CLI の権威ソース（claude docs / codex OSS enum @release タグ）へ合わせ、
その読み取りを src/config/slash-commands-attestations.json に記録し直すスキルです。
このスキルは「機械が出した差分を人が確定させる」手順である。
npm run catalog:refresh -- --writeは追加候補を流し込むだけで、 ja 訳・説明衝突・過去の除外判断の 3 点は決められない（Phase 4）。 そこを埋めずに commit すると、[要レビュー]混じりの ja 辞書と 「/btw — btw」のような説明が出荷される。
attestation は機械が書かない（Issue #2026）。 「版 V で source S は tool T についてこの集合を列挙した」という記録は
--writeの対象外で、人がソースを読んで書くときだけ動く。 カタログ側の pin が守る不変条件はcatalog(tool) ≡ attested(tool) \ excluded(tool)なので、--writeだけを適用すると[<tool>] /<name> is in the catalog but not attestedで赤くなる。 それが審査ゲートである。 カタログからコピーして緑にするとゲートが恒真になり、 「ソースがこう言っていた」が「カタログがこうなっている」の言い換えに退化する。
使用方法
/catalog-reconcile # 通常。codex は latest release タグを取る
/catalog-reconcile --codex-ref rust-v0.146.0 # codex のソースを特定タグに固定
前提条件
npm run buildを primary checkout で実行しない。 このスキルはリリース手順の一部として develop（＝稼働サーバの cwd）で走ることがある。build は.nextを作り替えてBUILD_IDを 変えるため、配信中の成果物を壊す（開いているタブの chunk が 404 になり遷移で client-side exception。過去 3 回発生）。build の検証は PR の CI に委ねる。- 作業ツリーが（このスキルが触る 3 ファイル以外）クリーンであること。stash しない （他エージェント稼働中だと破損の恐れ）。
- ネットワークが通ること。通らなくても壊れはしないが、「差分 0 件」と 「調べられなかった」が同じ見た目になる（Phase 1-3）。
このスキルが触るファイル
| ファイル | 誰が書くか |
|---|---|
src/config/slash-commands-catalog.json |
--write（追加は自動。除外は人間） |
locales/en/worktree.json |
--write が heuristic 抽出した英文 → 人手で文体を正す |
locales/ja/worktree.json |
--write が [要レビュー] プレースホルダを置く → 人手で全件翻訳 |
src/config/slash-commands-exclusions.json |
人間（除外の意図＝「ソースに在るが載せない」。engine はここを読んで再提案をやめる） |
src/config/slash-commands-attestations.json |
人間だけ（Issue #2026。「ソースが列挙した集合そのもの」＋版＋採取日。--write は触らない） |
tests/unit/lib/standard-commands.test.ts |
原則触らない（Issue #2026 で件数 pin は撤去され、期待値は attestation から導出される）。禁止系ガードは絶対に触らない |
tests/unit/lib/slash-command-catalog.test.ts |
人間（attestation の version を上げたときだけ。verifiedAgainst リテラルを持つ箇所） |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 23d ago Changed · +25 lines 35c0aec4a32c
- 1mo ago First seen · 687 lines · 62 tokens per session scan A d63f8ae5d193
catalog-reconcile is a skill published in the GitHub repository Kewton/CommandMate (44 stars, last pushed today), licensed MIT. It adds 62 tokens to every session and 12,788 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
luvus-module
Write a luvus module (an extension for luvus, mission control for your AI coding agents). Use when the user is building or debugging a luvus module: authoring luvus-module.toml, adding a sidebar dock, Luvus Bar widget, right-click action, event hook, module pane, module settings, or calling luvus back over its UHP.
gpui-mockup
Explore visual directions for a herdr-gpui UI element as real GPUI code. Write 3–4 variants in one Rust file, show them side by side in a native mockup window in the user's own theme and fonts, capture the window to check your work, and iterate on the picks and notes the user sends back. Use instead of the HTML mockup…
skill
Skill "skill" from wavyrai/tmux-ide, covering tmux-ide — claude code skill, when to use, the agent contract, coordinating with other agents and fleet control from the cli.
kanban-orchestrator
Kanban orchestrator: decompose, route, verify. No executing.
arch-check
An architecture and implementation review tool that examines how a codebase is modeled, divided into responsibilities, organized into modules, and connected by dependencies. It also checks for issues such as circular dependencies, over-design, and violations of common design principles.
cross-repo-delegate
A workflow for sending work tickets between separate code repositories. It lets an agent create a ticket for another project, then lets the receiving project list, claim, question, answer, or close that ticket.