Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/mateaix/matecloud/mate-oss-gatenpx skills add mateaix/matecloud --skill mate-oss-gategit clone --depth 1 https://github.com/mateaix/matecloudWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00081 | $0.00505 |
| Opus 5 | $0.00041 | $0.00253 |
| Sonnet 5 | $0.00016 | $0.00101 |
| Haiku 4.5 | $0.00008 | $0.00051 |
Grade A, and why
mate-oss-gate scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
开源 / 公开发布把关
MateCloud 是 开源项目：平台脚手架全部公开。
原则见 .claude/.harness/rules/04-open-source.md。
发布模型：私有 monorepo 为唯一真源 → 过滤发布到公开镜像仓（删企业目录 → 闸门 → squash 单 commit）。 绝不用 worktree / 同仓双分支（共享 git 历史会泄露企业代码）。
第一步：跑边界与泄露校验
bash .claude/.harness/checks/check-competitor-names.sh # 无 Dify/FastGPT/qKnow/sqlbot
bash .claude/.harness/checks/check-secrets.sh # 无真实密钥
bash .claude/.harness/checks/check-oss-boundary.sh # 开源模块不反向依赖企业模块
三项必须全绿。
第二步：内部路径泄露扫描（公开前手动确认）
grep -rniE "C:[\\\\/]+codes|/Users/[a-z]+/Codes|git\.mate\.vip" \
--include="*.md" --include="*.java" --include="*.yml" . | grep -v "/target/"
命中的发布前清掉或剔除。
第三步：开源治理文件
- 根目录有
LICENSE文件（README/pom 已声明 Apache-2.0，需落地文件）。 - README / CONTRIBUTING / CODE_OF_CONDUCT / SECURITY 齐全。
- 若接受外部贡献：CLA/DCO（open-core 需此才能把社区贡献用进商业版）。
出口判据
- 三项边界校验全绿
- 无内部路径 / 内网地址
- LICENSE 文件就位
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 42 lines · 81 tokens per session scan A d4368960e32a
mate-oss-gate is a skill published in the GitHub repository mateaix/matecloud (1,693 stars, last pushed 4d ago), licensed Apache-2.0. It adds 81 tokens to every session and 505 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
release-sample-sweep
Run the pre-release end-to-end sweep of every user-facing surface — the 33 samples under samples/ (booted from their packaged artifacts and driven in a real browser via chrome-devtools MCP), the Expo/React Native client, and the atmosphere CLI. Use before cutting a release, and after any change to the Console bundle…
shipping-and-launch
Pre-deploy hygiene for a Spring Boot 4 feature — verify gates, capture rollback plan, sign off observability, generate release notes, and stage the rollout. Used by /ship after /review approves the diff. The agent never deploys; it produces the plan a human executes.
release-notes
Draft concise release notes.
store-update
在 CCX Desktop 发布后下载 Store MSIX 并生成发布公告。用户提到 Store 上架、MSIX、从 GitHub Release 下载 store.msix、发布后同步 Windows Store、从 release 填写商店更新内容时必须使用此技能。该技能会下载最新 GitHub Release 的 amd64/arm64 MSIX，校验 sha256，从 Release body 生成 Store listing releaseNotes 预览，并输出手动上传指引。.
woc-release-merge-audit
Audit a release merge into a long-lived World of ClaudeCraft branch for semantic conflict damage, legacy drift, missed inventory updates, and invalidated planning assumptions. Use after merging a release branch, when reviewing a release merge commit, or before resuming feature work after upstream integration.
amazon-suspension-appeal
Account suspension prevention and appeal — policy violations, Plan of Action writing, reinstatement process.