Borrowing it
Nothing to install: this file belongs to Kewton/CommandMate. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/Kewton/CommandMate/main/.claude/skills/rebuild/SKILL.mdgit clone --depth 1 https://github.com/Kewton/CommandMateWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kewton/commandmate/rebuild)<a href="https://agentmods.dev/skills/kewton/commandmate/rebuild"><img src="https://agentmods.dev/badge/skills/kewton/commandmate/rebuild/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kewton/commandmate/rebuild"><img src="https://agentmods.dev/badge/skills/kewton/commandmate/rebuild.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Rogue Agent · line 31 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00055 | $0.01562 |
| Opus 5.5 | $0.00022 | $0.00625 |
| Sonnet 5.5 | $0.00011 | $0.00312 |
| Haiku 4.5 | $0.00006 | $0.00156 |
Grade A, and why
rebuild scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 101 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Rebuild
サーバーを停止し、ビルドしてバックグラウンドで再起動します。
⚠️ 最初に決めること: ビルドは要るのか(Issue #2132)
ビルドは「アプリケーションのコードが変わったとき」だけ必要です。
npm run build は .next/BUILD_ID を書き換えるため、開いているブラウザタブが chunk を取得できなくなって壊れます
(.commandmate/verify.yaml が skipInPrimaryCheckout: true でビルドを外しているのと同じ理由)。
| 状況 | 使うもの | ビルド |
|---|---|---|
src/ などコードを変更した |
このスキル(build-and-start.sh --daemon) |
する |
.env / 設定だけ変えた |
./scripts/restart-nobuild.sh |
しない |
| クラッシュしたサーバーを復帰させたい | ./scripts/restart-nobuild.sh |
しない |
| 停止中のサーバーを起こすだけ | ./scripts/start.sh --daemon |
しない |
ビルド不要と判断したら Step 2 の代わりに次を 1 回の Bash 呼び出しで実行し、完了報告形式はそのまま使う:
cd {TARGET_DIR} && ./scripts/restart-nobuild.sh
cd {TARGET_DIR} && CM_PORT={port} ./scripts/restart-nobuild.sh # ポート指定あり
手製の nohup npm start を使わないこと。 その前に source scripts/load-env.sh を叩く形になりますが、
このスクリプトは bash 専用で、zsh から source すると .env を 1 変数も読み込みません
(Issue #2132 以降はエラーで失敗しますが、正しい手段は上記の 2 スクリプトです)。
使用方法
/rebuild # 現在のリポジトリで実行
/rebuild feature/235-worktree # 指定ブランチのWorktreeで実行
/rebuild --port 3011 # ポート3011で起動
/rebuild feature/235-worktree --port 3011 # ブランチ指定+ポート指定
パラメータ
- branch_name: 対象ブランチ名(省略可)。指定時は
git worktree listからディレクトリを解決する。 - --port {number}: 起動ポート番号(省略可)。指定時は
CM_PORT環境変数を設定してサーバーを起動する。未指定時はデフォルト(3000)。
実行手順
Step 1: 実行ディレクトリの決定
-
ブランチ名が指定された場合:
git worktree listを実行し、指定ブランチに対応するディレクトリを取得する- 見つからない場合はエラー終了(「ブランチ '{branch_name}' に対応するWorktreeが見つかりません」)
- 見つかったディレクトリを
TARGET_DIRとする
-
ブランチ名が未指定の場合:
- 現在の作業ディレクトリ(プロジェクトルート)を
TARGET_DIRとする
- 現在の作業ディレクトリ(プロジェクトルート)を
Step 2: サーバー停止・ビルド・再起動
停止とビルド・再起動を 1回のBash呼び出し で実行する(ユーザーへの許可確認を1回に抑えるため)。
ポート指定なしの場合:
cd {TARGET_DIR} && ./scripts/stop.sh && ./scripts/build-and-start.sh --daemon
ポート指定ありの場合:
cd {TARGET_DIR} && CM_PORT={port} ./scripts/stop.sh && CM_PORT={port} ./scripts/build-and-start.sh --daemon
注意: ポート競合が発生した場合は lsof -nP -iTCP:{port} -sTCP:LISTEN -t で待ち受け中のプロセスを特定し、killしてから再試行する。
-sTCP:LISTEN を外すと、そのポートに接続しているだけのプロセス(CommandMate を開いているブラウザの network service、他セッションの CLI など)まで返り、止めると CommandMate 以外のタブの通信も一斉に切れる(Issue #2473)。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +1 lines fdbc468f44c4
- 1mo ago Changed · +25 lines 10ac155372c2
- 1mo ago First seen · 75 lines · 55 tokens per session scan A c881b977bea0
rebuild is a skill published in the GitHub repository Kewton/CommandMate (44 stars, last pushed today), licensed MIT. It adds 55 tokens to every session and 1,562 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
gpui-mockup
Explore visual directions for a herdr-gpui UI element as real GPUI code. Write 3–4 variants in one Rust file, show them side by side in a native mockup window in the user's own theme and fonts, capture the window to check your work, and iterate on the picks and notes the user sends back. Use instead of the HTML mockup…
vercel
Complete guide for the Vercel plugin — REST API access for deployments, logs, projects, and environment variables using a Vercel Personal Access Token.
blueprint-from-collection-import
Move the copied collection's records into Postgres and the files they point at into Storage, proven on a freshly reset local database.
blueprint-firebase-deploy-production
Deploy the same build to the production project.
blueprint-firebase-projects
Create or choose the dev and production Firebase projects and put them on the Blaze plan.
administer-microsoft-365-tenant
Microsoft 365 tenant administration for Global Administrators. Automate M365 tenant setup, Office 365 admin tasks, Azure AD user management, Exchange Online configuration, Teams administration, and security policies. Generate PowerShell scripts for bulk operations, Conditional A…