Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/kewton/commandmate/releasenpx skills add Kewton/CommandMate --skill releasegit clone --depth 1 https://github.com/Kewton/CommandMateWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00036 | $0.08322 |
| Opus 5 | $0.00018 | $0.04161 |
| Sonnet 5 | $0.00007 | $0.01664 |
| Haiku 4.5 | $0.00004 | $0.00832 |
Grade A, and why
release scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 549 lines — stays where its author put it; the contents beside it link to each section on GitHub.
リリーススキル
develop でバージョンを上げ、develop → main の PR 経由で main へ反映し、タグ・GitHub Release・develop へのマージバックまでを実行するスキルです。
npm publish は行いません。
.github/workflows/publish.ymlが GitHub Release のpublishedを契機に OIDC（npm Trusted Publishers）で自動 publish します。ローカルには publish 用の認証が無いため、npm publishを手元で実行してはいけません。
使用方法
/release patch # パッチバージョンアップ (0.10.0 → 0.10.1)
/release minor # マイナーバージョンアップ (0.10.0 → 0.11.0)
/release major # メジャーバージョンアップ (0.10.0 → 1.0.0)
/release 1.0.0 # 直接バージョン指定
前提条件
developブランチが最新で、origin/developと同期していること（リリースは develop 基点。main 基点ではない）- 作業ツリーがクリーンであること
- 検証ゲートが通ること（Phase 2-3 参照）。
npm run buildは primary checkout で回さない — 稼働サーバの.nextを壊すため。build の検証はリリース PR の CI が行う
全体の流れ
develop ──PR (squash)──> main ──annotated tag──> GitHub Release 作成
│
└─> publish.yml (OIDC) ──> npm
develop <──merge -s ours── main （祖先復元。squash で切れるため必須）
release/* ブランチは経由しない。 origin/release/v* は v0.5.x までしか存在せず、
release ブランチを切る手順（#1202）は v0.10.0 で廃止されている。publish.yml のトリガーは
on: release: types: [published] ＝ GitHub Release オブジェクトの公開であって、
ブランチへの push ではない。
このスキルは develop からしか実行できない（Phase 1-1 で確認し、それ以外は中断する）。
この手順が「なぜこの形か」
| 事実 | 理由 |
|---|---|
| main へ直接 push しない | .git/hooks/pre-push が protected_branch='main' で拒否する。PR 経由が唯一の経路 |
PR は develop → main |
v0.10.0 以降の実績（#1314 / #1325）。release/vX.Y.Z ブランチを切る旧手順（#1202）は使わない |
| squash マージ | 上記 PR は squash される。その結果 develop の祖先が切れるため、マージバックが必須になる |
マージバックは -s ours |
squash 後は main の tree が develop と同一なので、内容ではなく祖先関係だけを復元する |
| Release ノートは CHANGELOG 転記 | v0.10.0 以降の実績。--generate-notes は v0.9.1 までの形式 |
| npm publish しない | publish.yml が Release 契機で自動実行する（OIDC / provenance 付き） |
Phase 1: 事前確認
1-1. develop を最新化し、クリーンか確認
git checkout develop
git pull origin develop
git status --porcelain # 空であること
git rev-list --left-right --count develop...origin/develop # 0 0 であること
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 549 lines · 36 tokens per session scan A 911b9e7e958f
release is a skill published in the GitHub repository Kewton/CommandMate (39 stars, last pushed 2d ago), licensed MIT. It adds 36 tokens to every session and 8,322 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
verify
Drive CrowTelemetry's OTLP ingest end-to-end — boot the real receiver, POST OTLP JSON with curl, inspect the SQLite db.
crow-show-image
Surface an image you've generated (a diagram, chart, screenshot, or rendered figure) in Crow's Images panel so the user can see it inline. Use whenever you produce a visual artifact worth showing.
remobi-setup
Full interactive onboarding for remobi — the mobile terminal overlay for tmux. Checks prerequisites, inspects tmux config, interviews the user about their workflow, generates a validated remobi.config.ts, suggests tmux mobile optimisations, and walks through deployment. Use this skill whenever someone asks to set up…
build-and-verify
Build, test, and end-to-end verify the Multiplex visionOS/iPadOS SSH-tmux terminal app. Use this whenever you need to compile the app, run its unit tests, regenerate the Xcode project after editing project.yml or adding/ removing source files, or confirm a change works in the real app on the visionOS or iPad…
crow-batch-workspace
Set up multiple Crow workspaces in parallel, delegating to crow-workspace's setup.sh for each and firing them simultaneously to cut total setup time. Use when the user invokes /crow-batch-workspace or asks to set up several Crow workspaces at once.
crow-review-pr
Perform a comprehensive code and security review on a GitHub pull request, then post the findings as a PR review. Use when the user invokes /crow-review-pr or asks to review a pull request through Crow.