cmate-verify

A repository verification runner that records required checks such as linting, type checking, tests, and builds in a YAML file.

In plain words
What is it for?
Use it to define verification steps, run them one after another in a worktree, and decide whether work or parallel tasks are complete.
Why use it?
It gives a clear pass or fail result from actual command exit codes, so failed checks are not mistaken for success because of misleading output.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/kewton/commandmate/cmate-verify
Any agent
npx skills add Kewton/CommandMate --skill cmate-verify
Clone the repo
git clone --depth 1 https://github.com/Kewton/CommandMate

Made for: Claude Code, Codex.

Per session 106 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 8,116 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00106 $0.08116
Opus 5 $0.00053 $0.04058
Sonnet 5 $0.00021 $0.01623
Haiku 4.5 $0.00011 $0.00812

Measured 2d ago against content hash ec9c55c0cefc, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

cmate-verify scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

The scan reads SKILL.md. This mod also ships 2 executable files (scripts/tests/run-tests.sh, scripts/verify-run.sh), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.agents/skills/cmate-verify/SKILL.md · 414 lines

How it starts

The opening of the file, as written. The whole thing — 414 lines — stays where its author put it; the contents beside it link to each section on GitHub.

cmate-verify

「このリポジトリで何が通れば合格か」を .commandmate/verify.yaml に宣言し、 実 exit code で 判定するランナー。CommandMate 本体の検証ゲート (commandmate verify <worktree-id> / commandmate wait <worktree-id> --verify)の 代替ではなく、verify.yaml の起案(手順 1)と、CommandMate が無い環境でも bash と git だけで同じ判定を出すスタンドアロンランナー(手順 2)の 2 役である。

正準仕様は CommandMate リポジトリの docs/design/verification-config.md。 本体のローダ(src/lib/verification/verify-config.ts)は同じ仕様を一般的な YAML パーサで 実装するので、この Skill で書いた verify.yaml はそのまま引き継げる。

なぜ exit code か: cmd | grep ...$? を grep に渡して非ゼロ終了を隠す。vitest は 全テスト緑でも Unhandled Rejection で exit 1 を出しうるので、出力を grep した要約は それを PASS と報告してしまう。ゲートは必ず sh -c "$cmd" > log 2>&1 で走らせ $? を直接読む。

構成

cmate-verify/
├── SKILL.md
└── scripts/
    ├── verify-run.sh        # ゲート実行ランナー(bash 3.2 互換)
    └── tests/
        ├── run-tests.sh     # fixture ベーステスト(bash + git だけで動く)
        └── fixtures/*.yaml

scripts/tests/run-tests.sh は vitest に依存しない。Node の無い導入先でも bash scripts/tests/run-tests.sh だけで検証できる(CommandMate 本体では tests/unit/skills/cmate-verify/ の薄いラッパが npm run test:unit から同じ suite を回す)。

install 先は .claude/skills/cmate-verify/.agents/skills/cmate-verify/ の両方で、 中身は byte-identical である(Claude は前者、Codex は後者を読む)。以下のコマンド例は .claude/... で書いてあるが、.agents/... に読み替えても同じものが走る。

手順 1: init(.commandmate/verify.yaml が無い場合)

コードを書かず、リポジトリをスキャンしてゲートを起案し、ユーザーの確認を得てから書き出す。 検出優先順位は次のとおり。上位が見つかったら下位は補助として扱う。

  1. .github/workflows/*.yml の CI ジョブ — そのリポジトリにおける「何が通れば合格か」の 既存の定義。run: の各ステップが第一候補。
  2. package.jsonscriptslint / test / test:unit / typecheck / build 系。
  3. Makefile のターゲットmake lint / make test 等。
  4. 言語マニフェストCargo.tomlcargo clippy / cargo test)、pyproject.tomlruff / pytest / mypy)、go.modgo vet / go test ./...)等。

起案時の注意:

  • 実行時間の長いゲートには timeoutSec を明示する(既定は 600 秒)。
  • ゲートの並び順がそのまま実行順になる。速いゲートを先に置くと失敗が早く読める (途中で失敗しても残りは実行されるので、順序は打ち切りではなく可読性のための選択)。
  • デプロイ・publish・リリース・外形変更を伴うコマンドはゲートにしない。 ゲートは 何度でも安全に再実行できるものに限る。
  • 起案結果は「どこから拾ったか」(CI ジョブ名 / npm script 名)とセットで提示し、 ユーザーの確認を得てから .commandmate/verify.yaml を書き出す。

Read the full file on GitHub · 414 lines

Files

What ships with it

49 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 414 lines · 106 tokens per session scan A ec9c55c0cefc

Subscribe to this mod's changes

cmate-verify is a skill published in the GitHub repository Kewton/CommandMate (39 stars, last pushed 2d ago), licensed MIT. It adds 106 tokens to every session and 8,116 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

aoe

Use when launching, monitoring, or controlling AI coding agents (Claude Code, Codex, OpenCode, etc.) in tmux via Agent of Empires (aoe). Covers creating sessions, capturing agent output, running parallel worktree agents, and organizing work into groups and profiles. Prefer aoe over raw tmux for agent management.

agent-of-empires/agent-of-empires · 71 tokens

aoe

Manage AI coding agent sessions via Agent of Empires (aoe).

agent-of-empires/agent-of-empires · 17 tokens

verify

Drive CrowTelemetry's OTLP ingest end-to-end — boot the real receiver, POST OTLP JSON with curl, inspect the SQLite db.

corveil/crow · 30 tokens

crow-show-image

Surface an image you've generated (a diagram, chart, screenshot, or rendered figure) in Crow's Images panel so the user can see it inline. Use whenever you produce a visual artifact worth showing.

corveil/crow · 44 tokens

remobi-setup

Full interactive onboarding for remobi — the mobile terminal overlay for tmux. Checks prerequisites, inspects tmux config, interviews the user about their workflow, generates a validated remobi.config.ts, suggests tmux mobile optimisations, and walks through deployment. Use this skill whenever someone asks to set up…

connorads/remobi · 127 tokens

build-and-verify

Build, test, and end-to-end verify the Multiplex visionOS/iPadOS SSH-tmux terminal app. Use this whenever you need to compile the app, run its unit tests, regenerate the Xcode project after editing project.yml or adding/ removing source files, or confirm a change works in the real app on the visionOS or iPad…

multiplex-term/Multiplex · 176 tokens