A tool for automatically producing 30-second Japanese and English demo videos of CommandMate. It records scripted terminal sessions, adds captions, combines the footage, and checks the final length.

Creating MP4 or GIF demos from predefined storyboards, including localized interface recordings and burned-in captions.

It avoids slow and unpredictable recordings from a live language model while keeping the product's session-detection and interface behavior in the recording.

How Kewton/CommandMate configures Claude Code

Reuse

Borrowing it

Nothing to install: this file belongs to Kewton/CommandMate. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/Kewton/CommandMate/main/.agents/skills/demo-video/SKILL.md

Clone the repo

git clone --depth 1 https://github.com/Kewton/CommandMate

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/kewton/commandmate/demo-video/github.svg)](https://agentmods.dev/skills/kewton/commandmate/demo-video)

Your own site

<a href="https://agentmods.dev/skills/kewton/commandmate/demo-video"><img src="https://agentmods.dev/badge/skills/kewton/commandmate/demo-video/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/kewton/commandmate/demo-video"><img src="https://agentmods.dev/badge/skills/kewton/commandmate/demo-video.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 84 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 21,096 The whole file, excluding the scripts and references it only reads on demand.

Security scan C 2 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector warn 7 Sept 2026

SkillSpector: 9 findings, up to medium

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

medium MCP Rug Pull · line 4
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 139
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 190
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 191
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 213
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 262
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 398
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 399
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 67
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00084	$0.21096
Opus 5.5	$0.00034	$0.08438
Sonnet 5.5	$0.00017	$0.04219
Haiku 4.5	$0.00008	$0.02110

Measured 18d ago against content hash f160f8338f95, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade C, and why

demo-video scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 18d ago.

The scan reads SKILL.md. This mod also ships 11 executable files (scripts/cli-scene.sh, scripts/compose.sh, scripts/demo-video.sh, …), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Recursive force deletehighDestructive command

rm -rf with a variable or a broad path is one typo away from removing the wrong tree.

| #2380: 委任カセットの `@exec` は「`commandmate` 始まり」を許可条件にする | 先頭語だけの判定では `commandmate x; rm -rf …` が通る | 先頭語 `commandmate` **かつ**シェル演算子（`;` `&` `\|` バッククォート `$` `<` `>` `(` `)`）を含まない。差し込みは語分割の後 |

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

command -v tmux git curl node claude codex agy opencode commandcode || echo "missing"

.agents/skills/demo-video/SKILL.md · 553 lines

How it starts

The opening of the file, as written. The whole thing — 553 lines — stays where its author put it; the contents beside it link to each section on GitHub.

demo-video

CommandMate の 30 秒デモ動画を全自動生成する。demo-video.sh 一発で demo-30s.ja.mp4 と demo-30s.en.mp4 が出る。

export HOME=/Users/Shared/cmdemo-home                      # 必須。実ログイン HOME では env-up.sh が exit 2 で止まる（後述）
.claude/skills/demo-video/scripts/demo-video.sh            # ja + en
.claude/skills/demo-video/scripts/demo-video.sh --check    # 依存＋絵コンテ検証だけ
.claude/skills/demo-video/scripts/demo-video.sh --locale ja --gif --out ~/Desktop/cm-demo
.claude/skills/demo-video/scripts/demo-video.sh --storyboard readme-hero --gif   # README 冒頭の 30 秒（#2381）
.claude/skills/demo-video/scripts/demo-video.sh --claude-cassette .claude/skills/demo-video/fixtures/claude-delegate.cast   # 委任往復だけの take

出力先の既定は ~/Desktop/commandmate-demo/。リポジトリ外である。mp4 / GIF / 中間 PNG はコミットしない（配布は GitHub Release アセット等）。生成後に git status がクリーンであることが受入条件のひとつ。

絵コンテ一覧

`--storyboard`	出力	中身	claude ペインのカセット
`default`（既定）	`demo-30s.{ja,en}.mp4`	一覧 → 送信 → スマホ承認 → 完了（#1554）	`claude-session-sample.cast`
`contract-verify`	`contract-verify.{ja,en}.mp4`	契約 → 検証の 30 秒。code card 2 枚 + ターミナル収録（#1810）	同上
`readme-hero`	`demo-hero.{ja,en}.mp4` + `.gif`	README 冒頭の 30 秒。タブ帯 → 5 エージェント → チャット面で委任 → 返答のリンク → スマホで承認とファイル（#2381）	`claude-hero.cast`（絵コンテが `claude-cassette:` で宣言）

--storyboard は YAML のパスか、storyboard/ にある stem。絵コンテが claude-cassette: を持てばそのカセットで claude ペインを起こし（--claude-cassette で上書き可）、gif: を持てば --gif の幅 / fps / バイト予算はそこから読む。

README 撮影の env（#2381）

export HOME=/Users/Shared/cmdemo-home                                    # 実 HOME だと env-up.sh が exit 2。転写は $HOME 配下に置かれる
export PLAYWRIGHT_BROWSERS_PATH=/Users/<real>/Library/Caches/ms-playwright  # HOME を動かすと chromium が見つからない
export CM_DEMO_PORT=3481                                                 # 3000 は 3 箇所で拒否
export CM_DEMO_TMUX_SOCKET=cmdemo2381                                    # ターミナル収録の tmux -L（この絵コンテは使わないが習慣として）
unset TMUX
.claude/skills/demo-video/scripts/demo-video.sh --storyboard readme-hero --gif --out ~/Desktop/commandmate-demo/readme-hero

Read the full file on GitHub · 553 lines

Files

What ships with it

30 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

18d ago Changed f160f8338f95
23d ago Changed 6c6075cb4337
24d ago Changed dcb1934bee91
1mo ago Changed · +128 lines scan A → C 249d474cd167
1mo ago First seen · 425 lines · 84 tokens per session scan A 1ff6d9f69629

Subscribe to this mod's changes

demo-video is a skill published in the GitHub repository Kewton/CommandMate (44 stars, last pushed today), licensed MIT. It adds 84 tokens to every session and 21,096 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it C with 2 findings (recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Claude Code Creative and media agent-orchestration codex-cli developer-tools git-worktree tmux

luvus-module

Write a luvus module (an extension for luvus, mission control for your AI coding agents). Use when the user is building or debugging a luvus module: authoring luvus-module.toml, adding a sidebar dock, Luvus Bar widget, right-click action, event hook, module pane, module settings, or calling luvus back over its UHP.

RizRiyz/luvus · 79 tokens

gpui-mockup

Explore visual directions for a herdr-gpui UI element as real GPUI code. Write 3–4 variants in one Rust file, show them side by side in a native mockup window in the user's own theme and fonts, capture the window to check your work, and iterate on the picks and notes the user sends back. Use instead of the HTML mockup…

wavyrai/tmux-ide · 0 tokens

skill

Skill "skill" from wavyrai/tmux-ide, covering tmux-ide — claude code skill, when to use, the agent contract, coordinating with other agents and fleet control from the cli.

wavyrai/tmux-ide · 0 tokens

kanban-orchestrator

Kanban orchestrator: decompose, route, verify. No executing.

forcewake/hermes-conductor · 21 tokens

arch-check

An architecture and implementation review tool that examines how a codebase is modeled, divided into responsibilities, organized into modules, and connected by dependencies. It also checks for issues such as circular dependencies, over-design, and violations of common design principles.

AgentsMesh/AgentsMesh · 212 tokens

cross-repo-delegate

A workflow for sending work tickets between separate code repositories. It lets an agent create a ticket for another project, then lets the receiving project list, claim, question, answer, or close that ticket.

yunsii/wezdeck · 111 tokens

CommandMate: Skill for Claude Code