Навыки subagent-factory
📦

subagent-factory

Ревизия содержимого r1 Высокий риск ⚙️ Внешние команды🌐 Доступ к сети📁 Доступ к файловой системе🔑 Переменные окружения

Создание субагентов Claude Code

Создание полезных субагентов требует четкой области применения, безопасного доступа к инструментам и сильных промптов. Этот навык помогает пользователям Claude Code выстроить повторяемый процесс проектирования и настройки агентов.

Поддерживает: Claude Codex Code(CC)
⚠️ 38 Плохо

Установить с помощью моего Агента

Скопируйте этот запрос в своего Агента. Он содержит каноническую страницу Skill и манифест.

Запрос агента
Review the Skillstore skill "subagent-factory" from https://skillstore.io/skills/aaronabuusama-subagent-factory.md and its manifest at https://skillstore.io/api/skills/aaronabuusama-subagent-factory/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Ваш Агент по-прежнему должен показать план и запросить все подтверждения, требуемые политикой безопасности.

Ресурсы для AI-агентов

Используйте эти ссылки, когда AI-агенту, crawler или script нужен чистый контекст вместо полной страницы.

Markdown-детали GET /skills/aaronabuusama-subagent-factory.md Подписанный manifest GET /api/skills/aaronabuusama-subagent-factory/manifest Подписанный lockfile GET /api/skills/aaronabuusama-subagent-factory/lockfile

Протестировать

Использование «subagent-factory». Создай агента для ревью миграций базы данных.

Ожидаемый результат:

Предложенное имя агента, описание триггера, ограниченный список инструментов и сфокусированный промпт для проверки безопасности миграций.

Использование «subagent-factory». Мне нужна помощь с созданием агента, но я знаю только цель.

Ожидаемый результат:

Короткое интервью, которое уточняет область задачи, ожидаемые входные данные, необходимые инструменты и критерии успеха перед составлением агента.

Использование «subagent-factory». Сделай моего агента безопаснее.

Ожидаемый результат:

  • Выявляет слишком широкие инструменты.
  • Предлагает более узкое описание активации.
  • Переписывает промпт, чтобы избежать неоднозначных полномочий или области применения.

Аудит безопасности

Высокий риск
v11 • 09.07.2026 Открыть версионный отчет

Most static findings are documentation examples or Markdown false positives, but the skill intentionally discusses user-level Claude agent paths, shell hooks, command execution examples, network endpoints, and secret-bearing environment variables. These capabilities are not clearly malicious, but they are sensitive for a community skill and require careful review before publication.

13
Просканировано файлов
9,366
Проанализировано строк
84
Пункты проверки
0
Ложные срабатывания проигнорированы

Подтверждённые проблемы безопасности (1)

Высокий
research/slash-commands.md:903
Environment file access
credentials: JSON.parse(process.env.GOOGLE_CREDENTIALS),
The snippet references credentials or environment-provided secrets in example configuration. It appears instructional, but marketplace users should review it because copied examples can expose or mishandle secrets.
Пункты проверки возможностей (84)

Это реальные локальные возможности, которые могут ожидаться для этого навыка, поэтому они требуют проверки, но не считаются подтверждённым вредоносным поведением.

Высокий
references/advanced-features.md:499
Node.js child_process module
const { execSync } = require('child_process');
The snippet demonstrates Node child_process execution. Even as reference material, this is a real dangerous pattern if used in generated agents or MCP tooling without strict input control.
Высокий
references/advanced-features.md:500
Synchronous process execution
const output = execSync(`bd ready --min-priority=${priority || 'P4'}`, {
The snippet demonstrates Node child_process execution. Even as reference material, this is a real dangerous pattern if used in generated agents or MCP tooling without strict input control.
Высокий
references/agent-schema.md:27
Hidden file in home directory
**Path**: `~/.claude/agents/`
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Высокий
references/task-tool-reference.md:72
Hidden file in home directory
2. User agents: `~/.claude/agents/`
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Высокий
research/configuration.md:32
Hidden file in home directory
| `~/.claude/CLAUDE.md` | Global (all projects) | Lowest |
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Высокий
research/configuration.md:112
Hidden file in home directory
| `~/.claude/agents/` | User-level (all projects) | Lower |
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Высокий
research/configuration.md:228
Hidden file in home directory
| `~/.claude/skills/` | User-level (all projects) |
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Высокий
research/configuration.md:355
Hidden file in home directory
| `~/.claude/settings.json` | User (all projects) | Lowest | No |
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Высокий
research/configuration.md:369
Hidden file in home directory
5. **User settings** - `~/.claude/settings.json`
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Высокий
research/configuration.md:643
Hidden file in home directory
- `~/.claude/settings.json`
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Высокий
research/configuration.md:656
Hidden file in home directory
4. **Global User** - `~/.claude/CLAUDE.md`
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Высокий
research/existing-patterns.md:332
Hidden file in home directory
read ~/.claude/skills/solidity-btt-tests/CLAUDE.md
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Высокий
research/existing-patterns.md:337
Hidden file in home directory
ls ~/.claude/skills/solidity-btt-tests/templates/
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Высокий
research/slash-commands.md:27
Hidden file in home directory
- **User commands**: `~/.claude/commands/` (personal, all projects)
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Высокий
research/slash-commands.md:209
Hidden file in home directory
mkdir -p ~/.claude/commands
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Высокий
research/slash-commands.md:210
Hidden file in home directory
cat > ~/.claude/commands/security-review.md << 'EOF'
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Высокий
research/slash-commands.md:244
Hidden file in home directory
3. **User global**: `~/.claude/settings.local.json`
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Высокий
research/slash-commands.md:652
Hidden file in home directory
3. **User global**: `~/.claude/settings.local.json`
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Высокий
research/slash-commands.md:679
Git platform tokens
claude mcp add github -s user -e GITHUB_TOKEN=your-token -- npx -y @modelcontextprotocol/server-gith
The snippet references credentials or environment-provided secrets in example configuration. It appears instructional, but marketplace users should review it because copied examples can expose or mishandle secrets.
Высокий
research/slash-commands.md:682
Database connection strings
claude mcp add postgres -s user -e DATABASE_URL=your-db-url -- npx -y @modelcontextprotocol/server-p
The snippet references credentials or environment-provided secrets in example configuration. It appears instructional, but marketplace users should review it because copied examples can expose or mishandle secrets.
Высокий
research/slash-commands.md:596
Generic API/secret keys
-H "Authorization: Bearer $OPENAI_API_KEY" \
The snippet references credentials or environment-provided secrets in example configuration. It appears instructional, but marketplace users should review it because copied examples can expose or mishandle secrets.
Высокий
research/slash-commands.md:1062
Generic API/secret keys
claude mcp add my-server -s user -e API_KEY=secret -- node /path/to/server/index.js
The snippet references credentials or environment-provided secrets in example configuration. It appears instructional, but marketplace users should review it because copied examples can expose or mishandle secrets.
Высокий
SKILL.md:147
Hidden file in home directory
- **User-level**: `~/.claude/agents/` (personal agents)
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Высокий
workflows/interview-create.md:295
Hidden file in home directory
**B. User-level** (`~/.claude/agents/`)
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Высокий
workflows/quick-create.md:40
Hidden file in home directory
~/.claude/agents/[agent-name].md
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Высокий
workflows/quick-create.md:55
Hidden file in home directory
touch ~/.claude/agents/agent-name.md
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Высокий
workflows/quick-create.md:309
Hidden file in home directory
│ User: ~/.claude/agents/[name].md │
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Средний
references/advanced-features.md:500-512
Ruby/shell backtick execution
const output = execSync(`bd ready --min-priority=${priority || 'P4'}`, {
The snippet demonstrates Node child_process execution. Even as reference material, this is a real dangerous pattern if used in generated agents or MCP tooling without strict input control.
Средний
references/advanced-features.md:137
Shell command substitution
FILE_PATH=$(jq -r '.tool_input.file_path')
The snippet shows shell or process execution using values read from tool input or dynamic parameters. It appears instructional, but the pattern can become command injection or unsafe automation if copied directly.
Средний
references/advanced-features.md:57
xargs command (can execute arbitrary commands)
"command": "jq -r '.tool_input.file_path' | xargs npx prettier --write"
The snippet shows shell or process execution using values read from tool input or dynamic parameters. It appears instructional, but the pattern can become command injection or unsafe automation if copied directly.
Средний
references/agent-schema.md:27
Hidden file access
**Path**: `~/.claude/agents/`
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Средний
references/task-tool-reference.md:72
Hidden file access
2. User agents: `~/.claude/agents/`
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Средний
research/configuration.md:32
Hidden file access
| `~/.claude/CLAUDE.md` | Global (all projects) | Lowest |
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Средний
research/configuration.md:112
Hidden file access
| `~/.claude/agents/` | User-level (all projects) | Lower |
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Средний
research/configuration.md:228
Hidden file access
| `~/.claude/skills/` | User-level (all projects) |
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Средний
research/configuration.md:355
Hidden file access
| `~/.claude/settings.json` | User (all projects) | Lowest | No |
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Средний
research/configuration.md:369
Hidden file access
5. **User settings** - `~/.claude/settings.json`
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Средний
research/configuration.md:643
Hidden file access
- `~/.claude/settings.json`
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Средний
research/configuration.md:656
Hidden file access
4. **Global User** - `~/.claude/CLAUDE.md`
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Средний
research/configuration.md:463
Temp directory access
.claude/tmp/
The snippet references hidden Claude project files or backups. This is plausible legitimate agent tooling, but it is still filesystem-sensitive configuration access that should be reviewed.
Средний
research/existing-patterns.md:502-509
Ruby/shell backtick execution
- Use `.claude-plugin/agents/` for agent definitions
The snippet references hidden Claude project files or backups. This is plausible legitimate agent tooling, but it is still filesystem-sensitive configuration access that should be reviewed.
Средний
research/existing-patterns.md:516-517
Ruby/shell backtick execution
- **Skills**: Domain knowledge, workflows, patterns (in `.claude/skills/`)
The snippet references hidden Claude project files or backups. This is plausible legitimate agent tooling, but it is still filesystem-sensitive configuration access that should be reviewed.
Средний
research/existing-patterns.md:517-518
Ruby/shell backtick execution
- **Agents**: Autonomous executors with specific missions (in `.claude-plugin/agents/`)
The snippet references hidden Claude project files or backups. This is plausible legitimate agent tooling, but it is still filesystem-sensitive configuration access that should be reviewed.
Средний
research/existing-patterns.md:587-588
Ruby/shell backtick execution
- `/Users/abuusama/projects/solidity/beads/.claude-plugin/agents/task-agent.md`
The snippet references hidden Claude project files or backups. This is plausible legitimate agent tooling, but it is still filesystem-sensitive configuration access that should be reviewed.
Средний
research/existing-patterns.md:591-592
Ruby/shell backtick execution
- `/Users/abuusama/.claude/skills/create-skill/SKILL.md`
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Средний
research/existing-patterns.md:592-593
Ruby/shell backtick execution
- `/Users/abuusama/.claude/skills/example-skill/SKILL.md`
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Средний
research/existing-patterns.md:593-594
Ruby/shell backtick execution
- `/Users/abuusama/.claude/skills/research/SKILL.md`
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Средний
research/existing-patterns.md:594-595
Ruby/shell backtick execution
- `/Users/abuusama/.claude/skills/solidity-btt-tests/SKILL.md`
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Средний
research/existing-patterns.md:51
Hidden file access
### Global User Skills (`/Users/abuusama/.claude/skills/`)
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Средний
research/existing-patterns.md:332
Hidden file access
read ~/.claude/skills/solidity-btt-tests/CLAUDE.md
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Средний
research/existing-patterns.md:337
Hidden file access
ls ~/.claude/skills/solidity-btt-tests/templates/
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Средний
research/existing-patterns.md:587
Hidden file access
- `/Users/abuusama/projects/solidity/beads/.claude-plugin/agents/task-agent.md`
The snippet references hidden Claude project files or backups. This is plausible legitimate agent tooling, but it is still filesystem-sensitive configuration access that should be reviewed.
Средний
research/existing-patterns.md:591
Hidden file access
- `/Users/abuusama/.claude/skills/create-skill/SKILL.md`
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Средний
research/existing-patterns.md:592
Hidden file access
- `/Users/abuusama/.claude/skills/example-skill/SKILL.md`
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Средний
research/existing-patterns.md:593
Hidden file access
- `/Users/abuusama/.claude/skills/research/SKILL.md`
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Средний
research/existing-patterns.md:594
Hidden file access
- `/Users/abuusama/.claude/skills/solidity-btt-tests/SKILL.md`
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Средний
research/existing-patterns.md:595
Hidden file access
- `/Users/abuusama/.claude/skills/whitepaper-generator/SKILL.md`
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Средний
research/slash-commands.md:386
Shell command substitution
COMMAND=$(jq -r '.tool_input.command')
The snippet shows shell or process execution using values read from tool input or dynamic parameters. It appears instructional, but the pattern can become command injection or unsafe automation if copied directly.
Средний
research/slash-commands.md:456
Shell command substitution
FILE_PATH=$(jq -r '.tool_input.file_path')
The snippet shows shell or process execution using values read from tool input or dynamic parameters. It appears instructional, but the pattern can become command injection or unsafe automation if copied directly.
Средний
research/slash-commands.md:460
Shell command substitution
CONTENT=$(jq -r '.tool_input.content')
The snippet shows shell or process execution using values read from tool input or dynamic parameters. It appears instructional, but the pattern can become command injection or unsafe automation if copied directly.
Средний
research/slash-commands.md:495
Shell command substitution
FILE_PATH=$(jq -r '.tool_input.file_path')
The snippet shows shell or process execution using values read from tool input or dynamic parameters. It appears instructional, but the pattern can become command injection or unsafe automation if copied directly.
Средний
research/slash-commands.md:498
Shell command substitution
LINT_OUTPUT=$(npx eslint "$FILE_PATH" 2>&1)
The snippet shows shell or process execution using values read from tool input or dynamic parameters. It appears instructional, but the pattern can become command injection or unsafe automation if copied directly.
Средний
research/slash-commands.md:27
Hidden file access
- **User commands**: `~/.claude/commands/` (personal, all projects)
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Средний
research/slash-commands.md:209
Hidden file access
mkdir -p ~/.claude/commands
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Средний
research/slash-commands.md:210
Hidden file access
cat > ~/.claude/commands/security-review.md << 'EOF'
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Средний
research/slash-commands.md:244
Hidden file access
3. **User global**: `~/.claude/settings.local.json`
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Средний
research/slash-commands.md:609
Hidden file access
BACKUP_DIR="$CLAUDE_PROJECT_DIR/.claude/backups"
The snippet references hidden Claude project files or backups. This is plausible legitimate agent tooling, but it is still filesystem-sensitive configuration access that should be reviewed.
Средний
research/slash-commands.md:613
Hidden file access
cp "$CLAUDE_PROJECT_DIR/.claude/transcript.json" \
The snippet references hidden Claude project files or backups. This is plausible legitimate agent tooling, but it is still filesystem-sensitive configuration access that should be reviewed.
Средний
research/slash-commands.md:652
Hidden file access
3. **User global**: `~/.claude/settings.local.json`
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Средний
research/slash-commands.md:567
Temp directory access
} > /tmp/session-context.txt
The snippet writes session context to a shared temporary path. This is likely instructional but may expose development context if copied into automation.
Средний
research/slash-commands.md:570
Temp directory access
echo "Development context loaded. See /tmp/session-context.txt"
The snippet writes session context to a shared temporary path. This is likely instructional but may expose development context if copied into automation.
Средний
SKILL.md:146-147
Ruby/shell backtick execution
- **Project-level**: `.claude/agents/` (version controlled, team-shared)
The snippet references hidden Claude project files or backups. This is plausible legitimate agent tooling, but it is still filesystem-sensitive configuration access that should be reviewed.
Средний
SKILL.md:147-155
Ruby/shell backtick execution
- **User-level**: `~/.claude/agents/` (personal agents)
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Средний
SKILL.md:164-171
Ruby/shell backtick execution
**Custom agents**: Reference by name from `.claude/agents/`
The snippet references hidden Claude project files or backups. This is plausible legitimate agent tooling, but it is still filesystem-sensitive configuration access that should be reviewed.
Средний
SKILL.md:147
Hidden file access
- **User-level**: `~/.claude/agents/` (personal agents)
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Средний
workflows/interview-create.md:295
Hidden file access
**B. User-level** (`~/.claude/agents/`)
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Средний
workflows/quick-create.md:40
Hidden file access
~/.claude/agents/[agent-name].md
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Средний
workflows/quick-create.md:55
Hidden file access
touch ~/.claude/agents/agent-name.md
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Средний
workflows/quick-create.md:309
Hidden file access
│ User: ~/.claude/agents/[name].md │
The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.
Низкий
research/slash-commands.md:594
Hardcoded URL
curl -s https://api.openai.com/v1/chat/completions \
The snippet contains an external network endpoint in reference material. This appears legitimate documentation, but it is still a real network capability indicator.
Низкий
research/slash-commands.md:904
Hardcoded URL
scopes: ['https://www.googleapis.com/auth/calendar.readonly'],
The snippet contains an external network endpoint in reference material. This appears legitimate documentation, but it is still a real network capability indicator.
Низкий
research/slash-commands.md:969
Hardcoded URL
apiUrl: "https://api.example.com",
The snippet contains an external network endpoint in reference material. This appears legitimate documentation, but it is still a real network capability indicator.
Низкий
research/slash-commands.md:903
Environment variable access (dot notation)
credentials: JSON.parse(process.env.GOOGLE_CREDENTIALS),
The snippet references credentials or environment-provided secrets in example configuration. It appears instructional, but marketplace users should review it because copied examples can expose or mishandle secrets.
Низкий
research/slash-commands.md:903
Environment variable object
credentials: JSON.parse(process.env.GOOGLE_CREDENTIALS),
The snippet references credentials or environment-provided secrets in example configuration. It appears instructional, but marketplace users should review it because copied examples can expose or mishandle secrets.

Факторы риска

⚙️ Внешние команды (50)
references/advanced-features.md:499 references/advanced-features.md:500 references/advanced-features.md:200-201 references/advanced-features.md:201-202 references/advanced-features.md:202-218 references/advanced-features.md:317-318 references/advanced-features.md:318-319 references/advanced-features.md:319-328 references/advanced-features.md:328-329 references/advanced-features.md:329 references/advanced-features.md:351-361 references/advanced-features.md:500-512 references/advanced-features.md:512-522 references/advanced-features.md:538-542 references/advanced-features.md:587-588 references/advanced-features.md:588-624 references/advanced-features.md:80 references/advanced-features.md:81 references/advanced-features.md:82 references/advanced-features.md:137 references/advanced-features.md:145 references/advanced-features.md:77 references/advanced-features.md:134 references/advanced-features.md:57 references/agent-schema.md:288 references/agent-schema.md:319-320 references/agent-schema.md:320-321 references/prompt-patterns.md:167 references/prompt-patterns.md:296-300 references/prompt-patterns.md:300-304 references/prompt-patterns.md:338-339 references/prompt-patterns.md:339-340 references/prompt-patterns.md:340-343 references/prompt-patterns.md:398-402 references/prompt-patterns.md:446-447 references/prompt-patterns.md:447-450 references/prompt-patterns.md:700-736 references/prompt-patterns.md:841 references/prompt-patterns.md:853-922 references/prompt-patterns.md:931-935 references/prompt-patterns.md:935-938 references/prompt-patterns.md:938-940 research/configuration.md:81-82 research/configuration.md:82-83 research/configuration.md:83-86 research/configuration.md:86-87 research/configuration.md:87-88 research/configuration.md:88-92 research/configuration.md:92-98 research/configuration.md:191-205
🌐 Доступ к сети (4)
references/advanced-features.md:312 research/slash-commands.md:594 research/slash-commands.md:904 research/slash-commands.md:969
📁 Доступ к файловой системе (50)
references/advanced-features.md:140 references/advanced-features.md:145 references/agent-schema.md:27 references/agent-schema.md:27 references/prompt-patterns.md:894 references/task-tool-reference.md:72 references/task-tool-reference.md:72 research/configuration.md:32 research/configuration.md:112 research/configuration.md:228 research/configuration.md:355 research/configuration.md:369 research/configuration.md:643 research/configuration.md:656 research/configuration.md:32 research/configuration.md:112 research/configuration.md:228 research/configuration.md:355 research/configuration.md:369 research/configuration.md:643 research/configuration.md:656 research/configuration.md:463 research/existing-patterns.md:332 research/existing-patterns.md:337 research/existing-patterns.md:51 research/existing-patterns.md:332 research/existing-patterns.md:337 research/existing-patterns.md:587 research/existing-patterns.md:591 research/existing-patterns.md:592 research/existing-patterns.md:593 research/existing-patterns.md:594 research/existing-patterns.md:595 research/slash-commands.md:27 research/slash-commands.md:209 research/slash-commands.md:210 research/slash-commands.md:244 research/slash-commands.md:371 research/slash-commands.md:652 research/slash-commands.md:27 research/slash-commands.md:209 research/slash-commands.md:210 research/slash-commands.md:244 research/slash-commands.md:371 research/slash-commands.md:609 research/slash-commands.md:613 research/slash-commands.md:652 research/slash-commands.md:422 research/slash-commands.md:1224 research/slash-commands.md:567
🔑 Переменные окружения (6)
research/slash-commands.md:903 research/slash-commands.md:903 research/slash-commands.md:679 research/slash-commands.md:682 research/slash-commands.md:596 research/slash-commands.md:1062
Аудитор:: claude Посмотреть историю аудитов →
Поделиться и цитировать этот отчет

Делитесь версионным отчетом об оценке, нейтральным значком, встраиваемой карточкой и цитатами. Skillstore публикует доказательства, не решая, безопасен ли этот Skill.

Открыть версионный отчет
Оценка безопасности

Копировать ссылку на отчёт

https://skillstore.io/skills/aaronabuusama-subagent-factory/audits/11?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Значок Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/aaronabuusama-subagent-factory/security.svg)](https://skillstore.io/skills/aaronabuusama-subagent-factory?utm_source=security_passport_badge)

Значок HTML

<a href="https://skillstore.io/skills/aaronabuusama-subagent-factory?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/aaronabuusama-subagent-factory/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Встраиваемая карточка

<iframe src="https://skillstore.io/embed/skills/aaronabuusama-subagent-factory.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Академические ссылки (APA · BibTeX · CFF)

Цитата APA

AaronAbuUsama. (2026). subagent-factory security audit report (audit version 11) [Author version unspecified]. Skillstore. https://skillstore.io/skills/aaronabuusama-subagent-factory/audits/11

Цитата BibTeX

@techreport{aaronabuusama-aaronabuusama-subagent-factory-2026, author = {AaronAbuUsama}, title = {subagent-factory security audit report (audit version 11)}, institution = {Skillstore}, year = {2026}, number = {11}, url = {https://skillstore.io/skills/aaronabuusama-subagent-factory/audits/11}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "subagent-factory security audit report (audit version 11)" version: "unspecified" type: report authors: - name: "AaronAbuUsama" date-released: "2026-07-09" url: "https://skillstore.io/skills/aaronabuusama-subagent-factory/audits/11" identifiers: - type: other value: "skillstore:aaronabuusama-subagent-factory:audit:11" description: "Skillstore immutable audit report identifier"

Оценка Skillstore

Почему такая оценка Достоверность доказательств: Высокий
45
Архитектура
85
Сопровождаемость
87
Контент
82
Сообщество
83
Соответствие спецификации

Что вы можете построить

Создать специализированного агента для ревью

Определите субагента, который проверяет код для конкретного языка, фреймворка или стандарта качества.

Стандартизировать командную автоматизацию

Создайте агентов на уровне проекта, которые помогают команде последовательно выполнять одни и те же рабочие процессы.

Изучить проектирование агентов Claude Code

Изучите frontmatter, ограничение области инструментов и структуру промптов перед созданием пользовательских агентов.

Попробуйте эти промпты

Создать простого агента 
Создай субагента Claude Code для ревью pull requests на TypeScript. Ограничь инструменты чтением файлов и поиском по кодовой базе.
Спроектировать агента на основе требований 
Помоги мне спроектировать субагента для расследования flaky tests. Задай необходимые вопросы, затем предложи name, description, tools и prompt.
Улучшить существующего агента 
Проверь это определение агента и сделай его безопаснее и более сфокусированным. Уменьши количество ненужных инструментов и уточни, когда следует использовать агента.
Создать набор для многоагентного рабочего процесса 
Создай трех согласованных субагентов Claude Code для планирования, ревью реализации и диагностики тестов. Определи границы так, чтобы их обязанности не пересекались.

Лучшие практики

  • Предоставляйте каждому субагенту только те инструменты, которые требуются для его задачи.
  • Пишите описания активации, которые четко указывают, когда агент должен и не должен запускаться.
  • Предпочитайте агентов на уровне проекта для командных рабочих процессов, которые должны проходить ревью в системе контроля версий.

Избегать

  • Не создавайте широких агентов, которые могут редактировать, выполнять команды и управлять внешними системами без узкой цели.
  • Не помещайте конфиденциальные учетные данные или приватные сведения о проекте в переиспользуемые промпты агентов.
  • Не используйте пути агентов на уровне пользователя, когда рабочий процесс должен быть общим для команды и проходить ревью.

Часто задаваемые вопросы

Что создает этот навык?
Он помогает создавать файлы определений субагентов Claude Code с именами, описаниями, областями инструментов и промптами задач.
Может ли он создавать агентов для любой задачи?
Он может помочь со многими задачами разработчиков, но у каждого агента должна быть узкая и пригодная для ревью цель.
Устанавливает ли он агентов автоматически?
Навык предоставляет рабочие процессы и пути. Пользователям следует проверять любые изменения файлов перед использованием сгенерированного агента.
Как выбирать инструменты для агента?
Начните с инструментов только для чтения. Добавляйте инструменты редактирования или выполнения команд только тогда, когда они действительно нужны агенту.
Полезно ли это для команд?
Да. Команды могут использовать его для стандартизации агентов на уровне проекта, которые поддерживают рабочие процессы ревью кода, тестирования и исследований.
Что нужно проверить перед публикацией агента?
Проверьте описание его триггера, разрешения инструментов, пути файлов, внешние команды и любые ссылки на секреты или учетные данные.

Сведения для разработчиков

Автор

AaronAbuUsama

Лицензия

MIT

Ревизия Skillstore

r1

Примечание о версии

Автор не указал версию.

Репозиторий

https://github.com/AaronAbuUsama/alpha-arena/tree/develop/.claude/skills/subagent-factory

Ссылка

7db9b9f06e0ab79c575b58bc48c4d8dc9849f424

Актуальность поддержки

25.07.2026

Использование

9 загрузок · 1014 просмотров

Структура файлов

📁 references/

📄 advanced-features.md

📄 agent-schema.md

📄 prompt-patterns.md

📄 task-tool-reference.md

📁 research/

📄 configuration.md

📄 existing-patterns.md

📄 MANIFEST.md

📄 prompt-engineering.md

📄 slash-commands.md

📄 task-tool.md

📁 workflows/

📄 interview-create.md

📄 quick-create.md

📄 SKILL.md

Больше от AaronAbuUsama

Показать все
📦

prompting

78

Пишите более качественные промпты для AI-агентов

AI-агенты дают сбои, когда промпты расплывчаты, многословны или перегружены малополезным контекстом. Этот навык применяет принципы контекстной инженерии Anthropic, чтобы помочь вам писать ясные, структурированные и информативные промпты.

Продуктивность Просмотр
📦

system-design

77

Проектирование систем с чистой архитектурой

Сложные программные проекты часто терпят неудачу из-за неясных границ, доменных правил и компромиссов. Этот навык проводит Claude, Codex и Claude Code через исследование, моделирование, ADR и архитектурные каркасы на TypeScript.

Кодинг и разработка Просмотр
📦

smc-chart-analysis

75

Анализ торговых сетапов SMC

Трейдерам нужен структурированный SMC-анализ без ручной проверки каждого уровня ликвидности. Этот навык преобразует локальные данные графика в направление, точки входа, стопы, цели и предупреждения о рисках.

Данные и аналитика Просмотр
📦

smc-harness

75

Создавайте дисциплинированные планы для симулированной торговли BTC

Агентам симулированной торговли нужны единообразные правила преобразования рыночных наблюдений в документированные решения. Этот навык применяет структуру ICT/SMC, критерии входа и ограничения риска в рабочих процессах бэктестинга BTC/USDT.

Данные и аналитика Просмотр

Связанные навыки

Показать все
📦

building-agents

85

Создавайте агентов Claude Code

от C0ntr0lledCha0s

Создание надежных ИИ-агентов требует четких схем, безопасных инструментов и повторяемых этапов проверки. Этот навык помогает проектировать, проверять, мигрировать и поддерживать агентов для рабочих процессов Claude Code.

Кодинг и разработка Просмотр
📦

code-reviewer

83

Ревью кода со структурированными проверками качества

от alirezarezvani

При ревью кода можно упустить проблемы качества, безопасности и сопровождаемости. Этот навык помогает проводить структурированные ревью с помощью скриптов, чеклистов и генерации отчетов.

Кодинг и разработка Просмотр
📦

analyzing-component-quality

82

Анализ качества компонентов Claude Code

от C0ntr0lledCha0s

Командам нужны согласованные проверки перед публикацией компонентов Claude Code. Этот навык оценивает ясность, разрешения, триггеры, безопасность и удобство использования, а также дает конкретные рекомендации по улучшению.

Кодинг и разработка Просмотр
📦

senior-prompt-engineer

81

Проектируйте более качественные LLM-промпты

от alirezarezvani

Качество промптов часто страдает из-за неясных требований, примеров и критериев оценки. Этот навык помогает командам проектировать, тестировать и проверять production-промпты для Claude, Codex и Claude Code.

Кодинг и разработка Просмотр