Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/kewton/commandmate/cmate-verifynpx skills add Kewton/CommandMate --skill cmate-verifygit clone --depth 1 https://github.com/Kewton/CommandMateWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00106 | $0.08116 |
| Opus 5 | $0.00053 | $0.04058 |
| Sonnet 5 | $0.00021 | $0.01623 |
| Haiku 4.5 | $0.00011 | $0.00812 |
Grade A, and why
cmate-verify scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 414 lines — stays where its author put it; the contents beside it link to each section on GitHub.
cmate-verify
「このリポジトリで何が通れば合格か」を .commandmate/verify.yaml に宣言し、
実 exit code で 判定するランナー。CommandMate 本体の検証ゲート
(commandmate verify <worktree-id> / commandmate wait <worktree-id> --verify)の
代替ではなく、verify.yaml の起案(手順 1)と、CommandMate が無い環境でも bash と git
だけで同じ判定を出すスタンドアロンランナー(手順 2)の 2 役である。
正準仕様は CommandMate リポジトリの docs/design/verification-config.md。
本体のローダ(src/lib/verification/verify-config.ts)は同じ仕様を一般的な YAML パーサで
実装するので、この Skill で書いた verify.yaml はそのまま引き継げる。
なぜ exit code か:
cmd | grep ...は$?を grep に渡して非ゼロ終了を隠す。vitest は 全テスト緑でも Unhandled Rejection で exit 1 を出しうるので、出力を grep した要約は それを PASS と報告してしまう。ゲートは必ずsh -c "$cmd" > log 2>&1で走らせ$?を直接読む。
構成
cmate-verify/
├── SKILL.md
└── scripts/
├── verify-run.sh # ゲート実行ランナー(bash 3.2 互換)
└── tests/
├── run-tests.sh # fixture ベーステスト(bash + git だけで動く)
└── fixtures/*.yaml
scripts/tests/run-tests.sh は vitest に依存しない。Node の無い導入先でも
bash scripts/tests/run-tests.sh だけで検証できる(CommandMate 本体では
tests/unit/skills/cmate-verify/ の薄いラッパが npm run test:unit から同じ suite を回す)。
install 先は .claude/skills/cmate-verify/ と .agents/skills/cmate-verify/ の両方で、
中身は byte-identical である(Claude は前者、Codex は後者を読む)。以下のコマンド例は
.claude/... で書いてあるが、.agents/... に読み替えても同じものが走る。
手順 1: init(.commandmate/verify.yaml が無い場合)
コードを書かず、リポジトリをスキャンしてゲートを起案し、ユーザーの確認を得てから書き出す。 検出優先順位は次のとおり。上位が見つかったら下位は補助として扱う。
.github/workflows/*.ymlの CI ジョブ — そのリポジトリにおける「何が通れば合格か」の 既存の定義。run:の各ステップが第一候補。package.jsonのscripts—lint/test/test:unit/typecheck/build系。Makefileのターゲット —make lint/make test等。- 言語マニフェスト —
Cargo.toml(cargo clippy/cargo test)、pyproject.toml(ruff/pytest/mypy)、go.mod(go vet/go test ./...)等。
起案時の注意:
- 実行時間の長いゲートには
timeoutSecを明示する(既定は 600 秒)。 - ゲートの並び順がそのまま実行順になる。速いゲートを先に置くと失敗が早く読める (途中で失敗しても残りは実行されるので、順序は打ち切りではなく可読性のための選択)。
- デプロイ・publish・リリース・外形変更を伴うコマンドはゲートにしない。 ゲートは 何度でも安全に再実行できるものに限る。
- 起案結果は「どこから拾ったか」(CI ジョブ名 / npm script 名)とセットで提示し、
ユーザーの確認を得てから
.commandmate/verify.yamlを書き出す。
What ships with it
49 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- scripts/tests/fixtures/all-pass.yaml 299 B
- scripts/tests/fixtures/bad-anchor.yaml 55 B
- scripts/tests/fixtures/bad-block-scalar.yaml 57 B
- scripts/tests/fixtures/bad-duplicate-id.yaml 86 B
- scripts/tests/fixtures/bad-env-clean.yaml 81 B
- scripts/tests/fixtures/bad-flaky-alone.yaml 71 B
- scripts/tests/fixtures/bad-flaky-type.yaml 89 B
- scripts/tests/fixtures/bad-flow.yaml 52 B
- scripts/tests/fixtures/bad-gate-key.yaml 64 B
- scripts/tests/fixtures/bad-indent.yaml 50 B
- scripts/tests/fixtures/bad-invalid-id.yaml 57 B
- scripts/tests/fixtures/bad-missing-command.yaml 28 B
- scripts/tests/fixtures/bad-missing-id.yaml 39 B
- scripts/tests/fixtures/bad-mutex-length.yaml 126 B
- scripts/tests/fixtures/bad-mutex-name.yaml 69 B
- scripts/tests/fixtures/bad-no-gates.yaml 43 B
- scripts/tests/fixtures/bad-no-version.yaml 38 B
- scripts/tests/fixtures/bad-option-key.yaml 75 B
- scripts/tests/fixtures/bad-option-value.yaml 89 B
- scripts/tests/fixtures/bad-require-commit.yaml 81 B
- scripts/tests/fixtures/bad-reserved-env-clean.yaml 57 B
- scripts/tests/fixtures/bad-reserved-id.yaml 61 B
- scripts/tests/fixtures/bad-retry-range.yaml 68 B
- scripts/tests/fixtures/bad-retry-type.yaml 70 B
- scripts/tests/fixtures/bad-tab.yaml 46 B
- scripts/tests/fixtures/bad-timeout-range.yaml 71 B
- scripts/tests/fixtures/bad-timeout-type.yaml 69 B
- scripts/tests/fixtures/bad-version.yaml 49 B
- scripts/tests/fixtures/default-options.yaml 163 B
- scripts/tests/fixtures/mutex-flaky.yaml 535 B
- scripts/tests/fixtures/mutex-short.yaml 444 B
- scripts/tests/fixtures/mutex.yaml 511 B
- scripts/tests/fixtures/no-log-tail.yaml 341 B
- scripts/tests/fixtures/one-fail.yaml 428 B
- scripts/tests/fixtures/parsing.yaml 333 B
- scripts/tests/fixtures/require-commit.yaml 383 B
- scripts/tests/fixtures/require-env-clean.yaml 462 B
- scripts/tests/fixtures/retry-flaky-pass.yaml 516 B
- scripts/tests/fixtures/retry-flaky.yaml 712 B
- scripts/tests/fixtures/retry-hard-fail.yaml 605 B
- scripts/tests/fixtures/retry-thrice.yaml 759 B
- scripts/tests/fixtures/retry-timeout.yaml 385 B
- scripts/tests/fixtures/side-effect.yaml 201 B
- scripts/tests/fixtures/silent-fail.yaml 553 B
- scripts/tests/fixtures/timeout.yaml 585 B
- scripts/tests/fixtures/workdir-lifetime.yaml 3.1 KB
- scripts/tests/fixtures/worktree-env.yaml 538 B
- scripts/tests/run-tests.sh 59 KB runs code
- scripts/verify-run.sh 42 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 414 lines · 106 tokens per session scan A ec9c55c0cefc
cmate-verify is a skill published in the GitHub repository Kewton/CommandMate (39 stars, last pushed 2d ago), licensed MIT. It adds 106 tokens to every session and 8,116 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
aoe
Use when launching, monitoring, or controlling AI coding agents (Claude Code, Codex, OpenCode, etc.) in tmux via Agent of Empires (aoe). Covers creating sessions, capturing agent output, running parallel worktree agents, and organizing work into groups and profiles. Prefer aoe over raw tmux for agent management.
aoe
Manage AI coding agent sessions via Agent of Empires (aoe).
verify
Drive CrowTelemetry's OTLP ingest end-to-end — boot the real receiver, POST OTLP JSON with curl, inspect the SQLite db.
crow-show-image
Surface an image you've generated (a diagram, chart, screenshot, or rendered figure) in Crow's Images panel so the user can see it inline. Use whenever you produce a visual artifact worth showing.
remobi-setup
Full interactive onboarding for remobi — the mobile terminal overlay for tmux. Checks prerequisites, inspects tmux config, interviews the user about their workflow, generates a validated remobi.config.ts, suggests tmux mobile optimisations, and walks through deployment. Use this skill whenever someone asks to set up…
build-and-verify
Build, test, and end-to-end verify the Multiplex visionOS/iPadOS SSH-tmux terminal app. Use this whenever you need to compile the app, run its unit tests, regenerate the Xcode project after editing project.yml or adding/ removing source files, or confirm a change works in the real app on the visionOS or iPad…