agentmods.dev

CommandMate: Skill for Claude Code

.agents/skills/cmate-verify/SKILL.md

cmate-verify is a skill for Claude Code from Kewton/CommandMate. It costs 106 tokens per session (8,199 once invoked), scanned A, original, MIT.

A repository verification runner that records required checks such as linting, type checking, tests, and builds in a YAML file.

In plain words
What is it for?
Use it to define verification steps, run them one after another in a worktree, and decide whether work or parallel tasks are complete.
Why use it?
It gives a clear pass or fail result from actual command exit codes, so failed checks are not mistaken for success because of misleading output.

Skill for Claude Code

Written for Claude Code: allowed-tools in frontmatter. Also seen: reads .claude/ paths; installed under .agents/ (shared by several agents); mentions Codex.

This is Kewton/CommandMate's own configuration. It tells Claude Code how to work on CommandMate itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything CommandMate configures →

not rated 44repo changed 27d ago A scan SkillSpector: warn 106 tokens original MIT
View source ↗ Kewton/CommandMate kewton.github.io
Reuse

Borrowing it

Nothing to install: this file belongs to Kewton/CommandMate. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/Kewton/CommandMate/main/.agents/skills/cmate-verify/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/Kewton/CommandMate

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for cmate-verify

README.md
[![agentmods](https://agentmods.dev/badge/skills/kewton/commandmate/cmate-verify/github.svg)](https://agentmods.dev/skills/kewton/commandmate/cmate-verify)
Your own site
<a href="https://agentmods.dev/skills/kewton/commandmate/cmate-verify"><img src="https://agentmods.dev/badge/skills/kewton/commandmate/cmate-verify/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for cmate-verify

Your own site · 80×15
<a href="https://agentmods.dev/skills/kewton/commandmate/cmate-verify"><img src="https://agentmods.dev/badge/skills/kewton/commandmate/cmate-verify.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 106 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 8,199 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector warn 7 Sept 2026
SkillSpector: 1 finding, up to medium

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

  • medium MCP Rug Pull · line 137
    npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
    Fix: Pin the version: npx @scope/[email protected]
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00106 $0.08199
Opus 5.5 $0.00042 $0.03280
Sonnet 5.5 $0.00021 $0.01640
Haiku 4.5 $0.00011 $0.00820

Measured 27d ago against content hash 33c33e7a8d14, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

cmate-verify scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 27d ago.

The scan reads SKILL.md. This mod also ships 2 executable files (scripts/tests/run-tests.sh, scripts/verify-run.sh), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.agents/skills/cmate-verify/SKILL.md · 416 lines

How it starts

The opening of the file, as written. The whole thing — 416 lines — stays where its author put it; the contents beside it link to each section on GitHub.

cmate-verify

「このリポジトリで何が通れば合格か」を .commandmate/verify.yaml に宣言し、 実 exit code で 判定するランナー。CommandMate 本体の検証ゲート （commandmate verify <worktree-id> / commandmate wait <worktree-id> --verify）の 代替ではなく、verify.yaml の起案（手順 1）と、CommandMate が無い環境でも bash と git だけで同じ判定を出すスタンドアロンランナー（手順 2）の 2 役である。

正準仕様は CommandMate リポジトリの docs/design/verification-config.md。 本体のローダ（src/lib/verification/verify-config.ts）は同じ仕様を一般的な YAML パーサで 実装するので、この Skill で書いた verify.yaml はそのまま引き継げる。

なぜ exit code か: cmd | grep ... は $? を grep に渡して非ゼロ終了を隠す。vitest は 全テスト緑でも Unhandled Rejection で exit 1 を出しうるので、出力を grep した要約は それを PASS と報告してしまう。ゲートは必ず sh -c "$cmd" > log 2>&1 で走らせ $? を直接読む。

構成

cmate-verify/
├── SKILL.md
└── scripts/
    ├── verify-run.sh        # ゲート実行ランナー（bash 3.2 互換）
    └── tests/
        ├── run-tests.sh     # fixture ベーステスト（bash + git だけで動く）
        └── fixtures/*.yaml

scripts/tests/run-tests.sh は vitest に依存しない。Node の無い導入先でも bash scripts/tests/run-tests.sh だけで検証できる（CommandMate 本体では tests/unit/skills/cmate-verify/ の薄いラッパが npm run test:unit から同じ suite を回す）。

install 先は .claude/skills/cmate-verify/ と .agents/skills/cmate-verify/ の両方で、 中身は byte-identical である（Claude は前者、Codex と Command Code は後者を読む）。以下のコマンド例の <skills-root> は、worktree の root（git rev-parse --show-toplevel）の下の .agents/skills と .claude/skills のうち cmate-verify/SKILL.md が在る方である。どちらから実行しても同じものが走る。

手順 1: init（.commandmate/verify.yaml が無い場合）

コードを書かず、リポジトリをスキャンしてゲートを起案し、ユーザーの確認を得てから書き出す。 検出優先順位は次のとおり。上位が見つかったら下位は補助として扱う。

  1. .github/workflows/*.yml の CI ジョブ — そのリポジトリにおける「何が通れば合格か」の 既存の定義。run: の各ステップが第一候補。
  2. package.json の scripts — lint / test / test:unit / typecheck / build 系。
  3. Makefile のターゲット — make lint / make test 等。
  4. 言語マニフェスト — Cargo.toml（cargo clippy / cargo test）、pyproject.toml （ruff / pytest / mypy）、go.mod（go vet / go test ./...）等。

Read the full file on GitHub · 416 lines

Files

What ships with it

57 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 27d ago Changed · +2 lines 33c33e7a8d14
  2. 1mo ago First seen · 414 lines · 106 tokens per session scan A ec9c55c0cefc

Subscribe to this mod's changes

cmate-verify is a skill published in the GitHub repository Kewton/CommandMate (44 stars, last pushed today), licensed MIT. It adds 106 tokens to every session and 8,199 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Claude CodeTestingagent-orchestrationcodex-clideveloper-toolsgit-worktreetmux
Related

Other skills, from other repositories

e2e

Selects and runs the appropriate AgentsMesh end-to-end suite for Web, Desktop, MCP, or iOS, including worktree-specific environment setup and browser-level verification. Use when a change needs E2E coverage, a user asks to execute or diagnose an E2E test, or a cross-service workflow must be verified against the real…

AgentsMesh/AgentsMesh · 75 tokens

component-fixtures

Use when creating or updating component fixtures for screenshot testing, or when designing UI components to be fixture-friendly. Covers fixture file structure, theming, service setup, CSS scoping, async rendering, and common pitfalls.

workstream-labs/workstreams · 47 tokens

unit-tests

Use when running unit tests in the VS Code repo. Covers the runTests tool, scripts/test.sh (macOS/Linux) and scripts/test.bat (Windows), and their supported arguments for filtering, globbing, and debugging tests.

workstream-labs/workstreams · 50 tokens

update-screenshots

Download screenshot baselines from the latest CI run and commit them. Use when asked to update, accept, or refresh component screenshot baselines from CI, or after the screenshot-test GitHub Action reports differences. This skill should be run as a subagent.

workstream-labs/workstreams · 56 tokens

verify

Exercise the real app/API/CLI and collect observable evidence; tests alone do not count as end-to-end verification.

Hmbown/CodeWhale · 25 tokens

live-preview

Mid-build visual verification loop. Takes screenshots of components during construction, not just after. Catches visual regressions and invisible features before they compound. Requires Playwright or similar screenshot tool.

SethGammon/Citadel · 40 tokens