Habilidades subagent-factory
📦
subagent-factory
Revisão do conteúdo r1 Risco alto ⚙️ Comandos externos🌐 Acesso à rede📁 Acesso ao sistema de arquivos🔑 Variáveis de ambiente
Criar subagentes do Claude Code
Criar subagentes úteis exige escopo claro, acesso seguro a ferramentas e prompts fortes. Esta skill orienta usuários do Claude Code em um processo repetível de design e configuração de agentes.
Suporta: Claude Codex Code(CC)
Pare e solicite confirmação antes de instalar.
Revise o plano e obtenha o consentimento explícito do usuário antes de alterar arquivos.
Instalar com meu Agente
Copie esta solicitação para o seu Agente. Ela inclui a página canônica do Skill e o manifesto.
Solicitação do agente
Review the Skillstore skill "subagent-factory" from https://skillstore.io/skills/aaronabuusama-subagent-factory.md and its manifest at https://skillstore.io/api/skills/aaronabuusama-subagent-factory/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Seu Agente ainda deve apresentar o plano e solicitar qualquer confirmação exigida pela política de segurança.
Recursos legíveis por agentes
Use estes links quando um agente de IA, crawler ou script precisar de contexto limpo em vez de ler a página completa.
Testar
Usando "subagent-factory". Create an agent for database migration reviews.
Resultado esperado:
Um nome de agente proposto, descrição de acionamento, lista restrita de ferramentas e um prompt focado para revisar a segurança de migrações.
Usando "subagent-factory". I need help making an agent but I only know the goal.
Resultado esperado:
Uma entrevista curta que esclarece o escopo da tarefa, entradas esperadas, ferramentas necessárias e critérios de sucesso antes de redigir o agente.
Usando "subagent-factory". Make my agent safer.
Resultado esperado:
- Identifica ferramentas excessivamente amplas.
- Sugere uma descrição de ativação mais restrita.
- Reescreve o prompt para evitar autoridade ou escopo ambíguos.
Auditoria de segurança
Risco altov11 • 09/07/2026 Abrir o relatório versionado
Most static findings are documentation examples or Markdown false positives, but the skill intentionally discusses user-level Claude agent paths, shell hooks, command execution examples, network endpoints, and secret-bearing environment variables. These capabilities are not clearly malicious, but they are sensitive for a community skill and require careful review before publication.
13
Arquivos analisados
9,366
Linhas analisadas
84
Itens de revisão
0
Falsos positivos ignorados
Preocupações de segurança confirmadas (1)
Alto
Environment file access
credentials: JSON.parse(process.env.GOOGLE_CREDENTIALS),
The snippet references credentials or environment-provided secrets in example configuration. It appears instructional, but marketplace users should review it because copied examples can expose or mishandle secrets.
Itens de revisão de capacidade (84)
Estas são capacidades locais reais que podem ser esperadas para esta habilidade, portanto exigem revisão, mas não são contabilizadas como comportamento malicioso confirmado.
Alto
Node.js child_process module
const { execSync } = require('child_process');
The snippet demonstrates Node child_process execution. Even as reference material, this is a real dangerous pattern if used in generated agents or MCP tooling without strict input control.
Alto
Synchronous process execution
const output = execSync(`bd ready --min-priority=${priority || 'P4'}`, {
The snippet demonstrates Node child_process execution. Even as reference material, this is a real dangerous pattern if used in generated agents or MCP tooling without strict input control.
Alto
Hidden file in home directory
**Path**: `~/.claude/agents/`
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Alto
Hidden file in home directory
2. User agents: `~/.claude/agents/`
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Alto
Hidden file in home directory
| `~/.claude/CLAUDE.md` | Global (all projects) | Lowest |
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Alto
Hidden file in home directory
| `~/.claude/agents/` | User-level (all projects) | Lower |
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Alto
Hidden file in home directory
| `~/.claude/skills/` | User-level (all projects) |
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Alto
Hidden file in home directory
| `~/.claude/settings.json` | User (all projects) | Lowest | No |
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Alto
Hidden file in home directory
5. **User settings** - `~/.claude/settings.json`
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Alto
Hidden file in home directory
- `~/.claude/settings.json`
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Alto
Hidden file in home directory
4. **Global User** - `~/.claude/CLAUDE.md`
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Alto
Hidden file in home directory
read ~/.claude/skills/solidity-btt-tests/CLAUDE.md
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Alto
Hidden file in home directory
ls ~/.claude/skills/solidity-btt-tests/templates/
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Alto
Hidden file in home directory
- **User commands**: `~/.claude/commands/` (personal, all projects)
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Alto
Hidden file in home directory
mkdir -p ~/.claude/commands
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Alto
Hidden file in home directory
cat > ~/.claude/commands/security-review.md << 'EOF'
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Alto
Hidden file in home directory
3. **User global**: `~/.claude/settings.local.json`
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Alto
Hidden file in home directory
3. **User global**: `~/.claude/settings.local.json`
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Alto
Git platform tokens
claude mcp add github -s user -e GITHUB_TOKEN=your-token -- npx -y @modelcontextprotocol/server-gith
The snippet references credentials or environment-provided secrets in example configuration. It appears instructional, but marketplace users should review it because copied examples can expose or mishandle secrets.
Alto
Database connection strings
claude mcp add postgres -s user -e DATABASE_URL=your-db-url -- npx -y @modelcontextprotocol/server-p
The snippet references credentials or environment-provided secrets in example configuration. It appears instructional, but marketplace users should review it because copied examples can expose or mishandle secrets.
Alto
Generic API/secret keys
-H "Authorization: Bearer $OPENAI_API_KEY" \
The snippet references credentials or environment-provided secrets in example configuration. It appears instructional, but marketplace users should review it because copied examples can expose or mishandle secrets.
Alto
Generic API/secret keys
claude mcp add my-server -s user -e API_KEY=secret -- node /path/to/server/index.js
The snippet references credentials or environment-provided secrets in example configuration. It appears instructional, but marketplace users should review it because copied examples can expose or mishandle secrets.
Alto
Hidden file in home directory
- **User-level**: `~/.claude/agents/` (personal agents)
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Alto
Hidden file in home directory
**B. User-level** (`~/.claude/agents/`)
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Alto
Hidden file in home directory
~/.claude/agents/[agent-name].md
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Alto
Hidden file in home directory
touch ~/.claude/agents/agent-name.md
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Alto
Hidden file in home directory
│ User: ~/.claude/agents/[name].md │
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Médio
Ruby/shell backtick execution
const output = execSync(`bd ready --min-priority=${priority || 'P4'}`, {
The snippet demonstrates Node child_process execution. Even as reference material, this is a real dangerous pattern if used in generated agents or MCP tooling without strict input control.
Médio
Shell command substitution
FILE_PATH=$(jq -r '.tool_input.file_path')
The snippet shows shell or process execution using values read from tool input or dynamic parameters. It appears instructional, but the pattern can become command injection or unsafe automation if copied directly.
Médio
xargs command (can execute arbitrary commands)
"command": "jq -r '.tool_input.file_path' | xargs npx prettier --write"
The snippet shows shell or process execution using values read from tool input or dynamic parameters. It appears instructional, but the pattern can become command injection or unsafe automation if copied directly.
Médio
Hidden file access
**Path**: `~/.claude/agents/`
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Médio
Hidden file access
2. User agents: `~/.claude/agents/`
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Médio
Hidden file access
| `~/.claude/CLAUDE.md` | Global (all projects) | Lowest |
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Médio
Hidden file access
| `~/.claude/agents/` | User-level (all projects) | Lower |
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Médio
Hidden file access
| `~/.claude/skills/` | User-level (all projects) |
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Médio
Hidden file access
| `~/.claude/settings.json` | User (all projects) | Lowest | No |
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Médio
Hidden file access
5. **User settings** - `~/.claude/settings.json`
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Médio
Hidden file access
- `~/.claude/settings.json`
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Médio
Hidden file access
4. **Global User** - `~/.claude/CLAUDE.md`
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Médio
Temp directory access
.claude/tmp/
The snippet references hidden Claude project files or backups. This is plausible legitimate agent tooling, but it is still filesystem-sensitive configuration access that should be reviewed.
Médio
Ruby/shell backtick execution
- Use `.claude-plugin/agents/` for agent definitions
The snippet references hidden Claude project files or backups. This is plausible legitimate agent tooling, but it is still filesystem-sensitive configuration access that should be reviewed.
Médio
Ruby/shell backtick execution
- **Skills**: Domain knowledge, workflows, patterns (in `.claude/skills/`)
The snippet references hidden Claude project files or backups. This is plausible legitimate agent tooling, but it is still filesystem-sensitive configuration access that should be reviewed.
Médio
Ruby/shell backtick execution
- **Agents**: Autonomous executors with specific missions (in `.claude-plugin/agents/`)
The snippet references hidden Claude project files or backups. This is plausible legitimate agent tooling, but it is still filesystem-sensitive configuration access that should be reviewed.
Médio
Ruby/shell backtick execution
- `/Users/abuusama/projects/solidity/beads/.claude-plugin/agents/task-agent.md`
The snippet references hidden Claude project files or backups. This is plausible legitimate agent tooling, but it is still filesystem-sensitive configuration access that should be reviewed.
Médio
Ruby/shell backtick execution
- `/Users/abuusama/.claude/skills/create-skill/SKILL.md`
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Médio
Ruby/shell backtick execution
- `/Users/abuusama/.claude/skills/example-skill/SKILL.md`
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Médio
Ruby/shell backtick execution
- `/Users/abuusama/.claude/skills/research/SKILL.md`
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Médio
Ruby/shell backtick execution
- `/Users/abuusama/.claude/skills/solidity-btt-tests/SKILL.md`
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Médio
Hidden file access
### Global User Skills (`/Users/abuusama/.claude/skills/`)
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Médio
Hidden file access
read ~/.claude/skills/solidity-btt-tests/CLAUDE.md
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Médio
Hidden file access
ls ~/.claude/skills/solidity-btt-tests/templates/
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Médio
Hidden file access
- `/Users/abuusama/projects/solidity/beads/.claude-plugin/agents/task-agent.md`
The snippet references hidden Claude project files or backups. This is plausible legitimate agent tooling, but it is still filesystem-sensitive configuration access that should be reviewed.
Médio
Hidden file access
- `/Users/abuusama/.claude/skills/create-skill/SKILL.md`
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Médio
Hidden file access
- `/Users/abuusama/.claude/skills/example-skill/SKILL.md`
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Médio
Hidden file access
- `/Users/abuusama/.claude/skills/research/SKILL.md`
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Médio
Hidden file access
- `/Users/abuusama/.claude/skills/solidity-btt-tests/SKILL.md`
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Médio
Hidden file access
- `/Users/abuusama/.claude/skills/whitepaper-generator/SKILL.md`
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Médio
Shell command substitution
COMMAND=$(jq -r '.tool_input.command')
The snippet shows shell or process execution using values read from tool input or dynamic parameters. It appears instructional, but the pattern can become command injection or unsafe automation if copied directly.
Médio
Shell command substitution
FILE_PATH=$(jq -r '.tool_input.file_path')
The snippet shows shell or process execution using values read from tool input or dynamic parameters. It appears instructional, but the pattern can become command injection or unsafe automation if copied directly.
Médio
Shell command substitution
CONTENT=$(jq -r '.tool_input.content')
The snippet shows shell or process execution using values read from tool input or dynamic parameters. It appears instructional, but the pattern can become command injection or unsafe automation if copied directly.
Médio
Shell command substitution
FILE_PATH=$(jq -r '.tool_input.file_path')
The snippet shows shell or process execution using values read from tool input or dynamic parameters. It appears instructional, but the pattern can become command injection or unsafe automation if copied directly.
Médio
Shell command substitution
LINT_OUTPUT=$(npx eslint "$FILE_PATH" 2>&1)
The snippet shows shell or process execution using values read from tool input or dynamic parameters. It appears instructional, but the pattern can become command injection or unsafe automation if copied directly.
Médio
Hidden file access
- **User commands**: `~/.claude/commands/` (personal, all projects)
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Médio
Hidden file access
mkdir -p ~/.claude/commands
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Médio
Hidden file access
cat > ~/.claude/commands/security-review.md << 'EOF'
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Médio
Hidden file access
3. **User global**: `~/.claude/settings.local.json`
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Médio
Hidden file access
BACKUP_DIR="$CLAUDE_PROJECT_DIR/.claude/backups"
The snippet references hidden Claude project files or backups. This is plausible legitimate agent tooling, but it is still filesystem-sensitive configuration access that should be reviewed.
Médio
Hidden file access
cp "$CLAUDE_PROJECT_DIR/.claude/transcript.json" \
The snippet references hidden Claude project files or backups. This is plausible legitimate agent tooling, but it is still filesystem-sensitive configuration access that should be reviewed.
Médio
Hidden file access
3. **User global**: `~/.claude/settings.local.json`
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Médio
Temp directory access
} > /tmp/session-context.txt
The snippet writes session context to a shared temporary path. This is likely instructional but may expose development context if copied into automation.
Médio
Temp directory access
echo "Development context loaded. See /tmp/session-context.txt"
The snippet writes session context to a shared temporary path. This is likely instructional but may expose development context if copied into automation.
Médio
Ruby/shell backtick execution
- **Project-level**: `.claude/agents/` (version controlled, team-shared)
The snippet references hidden Claude project files or backups. This is plausible legitimate agent tooling, but it is still filesystem-sensitive configuration access that should be reviewed.
Médio
Ruby/shell backtick execution
- **User-level**: `~/.claude/agents/` (personal agents)
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Médio
Ruby/shell backtick execution
**Custom agents**: Reference by name from `.claude/agents/`
The snippet references hidden Claude project files or backups. This is plausible legitimate agent tooling, but it is still filesystem-sensitive configuration access that should be reviewed.
Médio
Hidden file access
- **User-level**: `~/.claude/agents/` (personal agents)
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Médio
Hidden file access
**B. User-level** (`~/.claude/agents/`)
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Médio
Hidden file access
~/.claude/agents/[agent-name].md
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Médio
Hidden file access
touch ~/.claude/agents/agent-name.md
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Médio
Hidden file access
│ User: ~/.claude/agents/[name].md │
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Baixo
Hardcoded URL
curl -s https://api.openai.com/v1/chat/completions \
The snippet contains an external network endpoint in reference material. This appears legitimate documentation, but it is still a real network capability indicator.
Baixo
Hardcoded URL
scopes: ['https://www.googleapis.com/auth/calendar.readonly'],
The snippet contains an external network endpoint in reference material. This appears legitimate documentation, but it is still a real network capability indicator.
Baixo
Hardcoded URL
apiUrl: "https://api.example.com",
The snippet contains an external network endpoint in reference material. This appears legitimate documentation, but it is still a real network capability indicator.
Baixo
Environment variable access (dot notation)
credentials: JSON.parse(process.env.GOOGLE_CREDENTIALS),
The snippet references credentials or environment-provided secrets in example configuration. It appears instructional, but marketplace users should review it because copied examples can expose or mishandle secrets.
Baixo
Environment variable object
credentials: JSON.parse(process.env.GOOGLE_CREDENTIALS),
The snippet references credentials or environment-provided secrets in example configuration. It appears instructional, but marketplace users should review it because copied examples can expose or mishandle secrets.
Fatores de risco
⚙️ Comandos externos (50)
references/advanced-features.md:499 references/advanced-features.md:500 references/advanced-features.md:200-201 references/advanced-features.md:201-202 references/advanced-features.md:202-218 references/advanced-features.md:317-318 references/advanced-features.md:318-319 references/advanced-features.md:319-328 references/advanced-features.md:328-329 references/advanced-features.md:329 references/advanced-features.md:351-361 references/advanced-features.md:500-512 references/advanced-features.md:512-522 references/advanced-features.md:538-542 references/advanced-features.md:587-588 references/advanced-features.md:588-624 references/advanced-features.md:80 references/advanced-features.md:81 references/advanced-features.md:82 references/advanced-features.md:137 references/advanced-features.md:145 references/advanced-features.md:77 references/advanced-features.md:134 references/advanced-features.md:57 references/agent-schema.md:288 references/agent-schema.md:319-320 references/agent-schema.md:320-321 references/prompt-patterns.md:167 references/prompt-patterns.md:296-300 references/prompt-patterns.md:300-304 references/prompt-patterns.md:338-339 references/prompt-patterns.md:339-340 references/prompt-patterns.md:340-343 references/prompt-patterns.md:398-402 references/prompt-patterns.md:446-447 references/prompt-patterns.md:447-450 references/prompt-patterns.md:700-736 references/prompt-patterns.md:841 references/prompt-patterns.md:853-922 references/prompt-patterns.md:931-935 references/prompt-patterns.md:935-938 references/prompt-patterns.md:938-940 research/configuration.md:81-82 research/configuration.md:82-83 research/configuration.md:83-86 research/configuration.md:86-87 research/configuration.md:87-88 research/configuration.md:88-92 research/configuration.md:92-98 research/configuration.md:191-205
🌐 Acesso à rede (4)
📁 Acesso ao sistema de arquivos (50)
references/advanced-features.md:140 references/advanced-features.md:145 references/agent-schema.md:27 references/agent-schema.md:27 references/prompt-patterns.md:894 references/task-tool-reference.md:72 references/task-tool-reference.md:72 research/configuration.md:32 research/configuration.md:112 research/configuration.md:228 research/configuration.md:355 research/configuration.md:369 research/configuration.md:643 research/configuration.md:656 research/configuration.md:32 research/configuration.md:112 research/configuration.md:228 research/configuration.md:355 research/configuration.md:369 research/configuration.md:643 research/configuration.md:656 research/configuration.md:463 research/existing-patterns.md:332 research/existing-patterns.md:337 research/existing-patterns.md:51 research/existing-patterns.md:332 research/existing-patterns.md:337 research/existing-patterns.md:587 research/existing-patterns.md:591 research/existing-patterns.md:592 research/existing-patterns.md:593 research/existing-patterns.md:594 research/existing-patterns.md:595 research/slash-commands.md:27 research/slash-commands.md:209 research/slash-commands.md:210 research/slash-commands.md:244 research/slash-commands.md:371 research/slash-commands.md:652 research/slash-commands.md:27 research/slash-commands.md:209 research/slash-commands.md:210 research/slash-commands.md:244 research/slash-commands.md:371 research/slash-commands.md:609 research/slash-commands.md:613 research/slash-commands.md:652 research/slash-commands.md:422 research/slash-commands.md:1224 research/slash-commands.md:567
Auditado por: claude Ver histórico de auditoria →
Compartilhar e citar este relatório
Compartilhe o relatório de avaliação versionado, o badge neutro, o cartão incorporável e as citações. A Skillstore apresenta evidências sem decidir se este Skill é seguro.
Copiar link do relatório
https://skillstore.io/skills/aaronabuusama-subagent-factory/audits/11?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportBadge Markdown
[](https://skillstore.io/skills/aaronabuusama-subagent-factory?utm_source=security_passport_badge)Badge HTML
<a href="https://skillstore.io/skills/aaronabuusama-subagent-factory?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/aaronabuusama-subagent-factory/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Cartão incorporável
<iframe src="https://skillstore.io/embed/skills/aaronabuusama-subagent-factory.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Citações acadêmicas (APA · BibTeX · CFF)
Citação APA
AaronAbuUsama. (2026). subagent-factory security audit report (audit version 11) [Author version unspecified]. Skillstore. https://skillstore.io/skills/aaronabuusama-subagent-factory/audits/11Citação BibTeX
@techreport{aaronabuusama-aaronabuusama-subagent-factory-2026,
author = {AaronAbuUsama},
title = {subagent-factory security audit report (audit version 11)},
institution = {Skillstore},
year = {2026},
number = {11},
url = {https://skillstore.io/skills/aaronabuusama-subagent-factory/audits/11},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "subagent-factory security audit report (audit version 11)"
version: "unspecified"
type: report
authors:
- name: "AaronAbuUsama"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/aaronabuusama-subagent-factory/audits/11"
identifiers:
- type: other
value: "skillstore:aaronabuusama-subagent-factory:audit:11"
description: "Skillstore immutable audit report identifier"
Pontuação do Skillstore
Por que esta pontuação Confiança das evidências: Alto 45
Arquitetura
85
Manutenibilidade
87
Conteúdo
82
Comunidade
83
Conformidade com a especificação
O que você pode criar
Criar um agente de revisão focado
Defina um subagente que revise código para uma linguagem, framework ou padrão de qualidade específico.
Padronizar a automação da equipe
Crie agentes em nível de projeto que ajudem uma equipe a executar os mesmos fluxos de trabalho de forma consistente.
Aprender design de agentes do Claude Code
Estude frontmatter, escopo de ferramentas e estrutura de prompts antes de criar agentes personalizados.
Teste estes prompts
Criar um agente simples
Create a Claude Code subagent for reviewing TypeScript pull requests. Keep the tools limited to reading files and searching the codebase.
Projetar um agente a partir de requisitos
Help me design a subagent for investigating flaky tests. Ask any needed questions, then propose the name, description, tools, and prompt.
Refinar um agente existente
Review this agent definition and make it safer and more focused. Reduce unnecessary tools and clarify when the agent should be used.
Criar um conjunto de fluxo de trabalho multiagente
Create three coordinated Claude Code subagents for planning, implementation review, and test diagnosis. Define boundaries so their responsibilities do not overlap.
Boas práticas
- Conceda a cada subagente apenas as ferramentas necessárias para sua tarefa.
- Escreva descrições de ativação que indiquem claramente quando o agente deve e não deve ser executado.
- Prefira agentes em nível de projeto para fluxos de trabalho de equipe que devem ser revisados no controle de versão.
Evitar
- Não crie agentes amplos que possam editar, executar comandos e gerenciar sistemas externos sem um propósito restrito.
- Não coloque credenciais confidenciais ou detalhes privados do projeto em prompts de agentes reutilizáveis.
- Não use caminhos de agentes em nível de usuário quando o fluxo de trabalho deve ser compartilhado e revisado por uma equipe.
Perguntas frequentes
O que esta skill cria?
Ela ajuda a criar arquivos de definição de subagentes do Claude Code com nomes, descrições, escopos de ferramentas e prompts de tarefas.
Ela pode criar agentes para qualquer tarefa?
Ela pode orientar muitas tarefas de desenvolvimento, mas cada agente deve ter um propósito restrito e revisável.
Ela instala agentes automaticamente?
A skill fornece fluxos de trabalho e caminhos. Os usuários devem revisar quaisquer alterações de arquivo antes de usar um agente gerado.
Como devo escolher ferramentas para um agente?
Comece com ferramentas somente leitura. Adicione ferramentas de edição ou comando apenas quando o agente realmente precisar delas.
Isso é útil para equipes?
Sim. Equipes podem usá-la para padronizar agentes em nível de projeto que apoiem fluxos de trabalho de revisão de código, testes e pesquisa.
O que devo revisar antes de publicar um agente?
Revise a descrição de acionamento, permissões de ferramentas, caminhos de arquivos, comandos externos e quaisquer referências a segredos ou credenciais.
Detalhes do desenvolvedor
Autor
AaronAbuUsamaLicença
MIT
Revisão da Skillstore
r1
Aviso de versão
O autor não declarou uma versão.
Repositório
https://github.com/AaronAbuUsama/alpha-arena/tree/develop/.claude/skills/subagent-factoryReferência
7db9b9f06e0ab79c575b58bc48c4d8dc9849f424
Atualidade da manutenção
28/07/2026
Uso
9 downloads · 1014 visualizações
Estrutura de arquivos