Skills subagent-factory

📦

subagent-factory

Name: subagent-factory
Author: AaronAbuUsama

Content revision r1 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables

Create Claude Code Subagents

Creating useful subagents requires clear scope, safe tool access, and strong prompts. This skill guides Claude Code users through repeatable agent design and setup.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "subagent-factory" from https://skillstore.io/skills/aaronabuusama-subagent-factory.md and its manifest at https://skillstore.io/api/skills/aaronabuusama-subagent-factory/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/aaronabuusama-subagent-factory.md Signed manifest GET /api/skills/aaronabuusama-subagent-factory/manifest Signed lockfile GET /api/skills/aaronabuusama-subagent-factory/lockfile

Test it

Using "subagent-factory". Create an agent for database migration reviews.

Expected outcome:

A proposed agent name, trigger description, restricted tool list, and a focused prompt for reviewing migration safety.

Using "subagent-factory". I need help making an agent but I only know the goal.

Expected outcome:

A short interview that clarifies task scope, expected inputs, required tools, and success criteria before drafting the agent.

Using "subagent-factory". Make my agent safer.

Expected outcome:

Identifies overly broad tools.
Suggests a narrower activation description.
Rewrites the prompt to avoid ambiguous authority or scope.

Security Audit

High Risk

v11 • 7/9/2026 Open versioned report

Most static findings are documentation examples or Markdown false positives, but the skill intentionally discusses user-level Claude agent paths, shell hooks, command execution examples, network endpoints, and secret-bearing environment variables. These capabilities are not clearly malicious, but they are sensitive for a community skill and require careful review before publication.

Files scanned

9,366

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

High

research/slash-commands.md:903

Environment file access

credentials: JSON.parse(process.env.GOOGLE_CREDENTIALS),

The snippet references credentials or environment-provided secrets in example configuration. It appears instructional, but marketplace users should review it because copied examples can expose or mishandle secrets.

Capability review items (84)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

references/advanced-features.md:499

Node.js child_process module

const { execSync } = require('child_process');

The snippet demonstrates Node child_process execution. Even as reference material, this is a real dangerous pattern if used in generated agents or MCP tooling without strict input control.

High

references/advanced-features.md:500

Synchronous process execution

const output = execSync(`bd ready --min-priority=${priority || 'P4'}`, {

The snippet demonstrates Node child_process execution. Even as reference material, this is a real dangerous pattern if used in generated agents or MCP tooling without strict input control.

High

references/agent-schema.md:27

Hidden file in home directory

**Path**: `~/.claude/agents/`

The skill documents or instructs access to user-level Claude configuration or agent paths under ~/.claude. This matches the skill purpose but is security-sensitive because it can affect all Claude Code projects for that user.

High

references/task-tool-reference.md:72

Hidden file in home directory

2. User agents: `~/.claude/agents/`

High

research/configuration.md:32

Hidden file in home directory

| `~/.claude/CLAUDE.md` | Global (all projects) | Lowest |

High

research/configuration.md:112

Hidden file in home directory

| `~/.claude/agents/` | User-level (all projects) | Lower |

High

research/configuration.md:228

Hidden file in home directory

| `~/.claude/skills/` | User-level (all projects) |

High

research/configuration.md:355

Hidden file in home directory

High

research/configuration.md:369

Hidden file in home directory

5. **User settings** - `~/.claude/settings.json`

High

research/configuration.md:643

Hidden file in home directory

- `~/.claude/settings.json`

High

research/configuration.md:656

Hidden file in home directory

4. **Global User** - `~/.claude/CLAUDE.md`

High

research/existing-patterns.md:332

Hidden file in home directory

read ~/.claude/skills/solidity-btt-tests/CLAUDE.md

High

research/existing-patterns.md:337

Hidden file in home directory

ls ~/.claude/skills/solidity-btt-tests/templates/

High

research/slash-commands.md:27

Hidden file in home directory

- **User commands**: `~/.claude/commands/` (personal, all projects)

High

research/slash-commands.md:209

Hidden file in home directory

mkdir -p ~/.claude/commands

High

research/slash-commands.md:210

Hidden file in home directory

cat > ~/.claude/commands/security-review.md << 'EOF'

High

research/slash-commands.md:244

Hidden file in home directory

3. **User global**: `~/.claude/settings.local.json`

High

research/slash-commands.md:652

Hidden file in home directory

3. **User global**: `~/.claude/settings.local.json`

High

research/slash-commands.md:679

Git platform tokens

claude mcp add github -s user -e GITHUB_TOKEN=your-token -- npx -y @modelcontextprotocol/server-gith

High

research/slash-commands.md:682

Database connection strings

claude mcp add postgres -s user -e DATABASE_URL=your-db-url -- npx -y @modelcontextprotocol/server-p

High

research/slash-commands.md:596

Generic API/secret keys

-H "Authorization: Bearer $OPENAI_API_KEY" \

High

research/slash-commands.md:1062

Generic API/secret keys

claude mcp add my-server -s user -e API_KEY=secret -- node /path/to/server/index.js

High

SKILL.md:147

Hidden file in home directory

- **User-level**: `~/.claude/agents/` (personal agents)

High

workflows/interview-create.md:295

Hidden file in home directory

**B. User-level** (`~/.claude/agents/`)

High

workflows/quick-create.md:40

Hidden file in home directory

~/.claude/agents/[agent-name].md

High

workflows/quick-create.md:55

Hidden file in home directory

touch ~/.claude/agents/agent-name.md

High

workflows/quick-create.md:309

Hidden file in home directory

│ User: ~/.claude/agents/[name].md │

Medium

references/advanced-features.md:500-512

Ruby/shell backtick execution

const output = execSync(`bd ready --min-priority=${priority || 'P4'}`, {

The snippet demonstrates Node child_process execution. Even as reference material, this is a real dangerous pattern if used in generated agents or MCP tooling without strict input control.

Medium

references/advanced-features.md:137

Shell command substitution

FILE_PATH=$(jq -r '.tool_input.file_path')

The snippet shows shell or process execution using values read from tool input or dynamic parameters. It appears instructional, but the pattern can become command injection or unsafe automation if copied directly.

Medium

references/advanced-features.md:57

xargs command (can execute arbitrary commands)

"command": "jq -r '.tool_input.file_path' | xargs npx prettier --write"

Medium

references/agent-schema.md:27

Hidden file access

**Path**: `~/.claude/agents/`

Medium

references/task-tool-reference.md:72

Hidden file access

2. User agents: `~/.claude/agents/`

Medium

research/configuration.md:32

Hidden file access

| `~/.claude/CLAUDE.md` | Global (all projects) | Lowest |

Medium

research/configuration.md:112

Hidden file access

| `~/.claude/agents/` | User-level (all projects) | Lower |

Medium

research/configuration.md:228

Hidden file access

| `~/.claude/skills/` | User-level (all projects) |

Medium

research/configuration.md:355

Hidden file access

Medium

research/configuration.md:369

Hidden file access

5. **User settings** - `~/.claude/settings.json`

Medium

research/configuration.md:643

Hidden file access

- `~/.claude/settings.json`

Medium

research/configuration.md:656

Hidden file access

4. **Global User** - `~/.claude/CLAUDE.md`

Medium

research/configuration.md:463

Temp directory access

.claude/tmp/

The snippet references hidden Claude project files or backups. This is plausible legitimate agent tooling, but it is still filesystem-sensitive configuration access that should be reviewed.

Medium

research/existing-patterns.md:502-509

Ruby/shell backtick execution

- Use `.claude-plugin/agents/` for agent definitions

The snippet references hidden Claude project files or backups. This is plausible legitimate agent tooling, but it is still filesystem-sensitive configuration access that should be reviewed.

Medium

research/existing-patterns.md:516-517

Ruby/shell backtick execution

- **Skills**: Domain knowledge, workflows, patterns (in `.claude/skills/`)

The snippet references hidden Claude project files or backups. This is plausible legitimate agent tooling, but it is still filesystem-sensitive configuration access that should be reviewed.

Medium

research/existing-patterns.md:517-518

Ruby/shell backtick execution

- **Agents**: Autonomous executors with specific missions (in `.claude-plugin/agents/`)

The snippet references hidden Claude project files or backups. This is plausible legitimate agent tooling, but it is still filesystem-sensitive configuration access that should be reviewed.

Medium

research/existing-patterns.md:587-588

Ruby/shell backtick execution

- `/Users/abuusama/projects/solidity/beads/.claude-plugin/agents/task-agent.md`

The snippet references hidden Claude project files or backups. This is plausible legitimate agent tooling, but it is still filesystem-sensitive configuration access that should be reviewed.

Medium

research/existing-patterns.md:591-592

Ruby/shell backtick execution

- `/Users/abuusama/.claude/skills/create-skill/SKILL.md`

Medium

research/existing-patterns.md:592-593

Ruby/shell backtick execution

- `/Users/abuusama/.claude/skills/example-skill/SKILL.md`

Medium

research/existing-patterns.md:593-594

Ruby/shell backtick execution

- `/Users/abuusama/.claude/skills/research/SKILL.md`

Medium

research/existing-patterns.md:594-595

Ruby/shell backtick execution

- `/Users/abuusama/.claude/skills/solidity-btt-tests/SKILL.md`

Medium

research/existing-patterns.md:51

Hidden file access

### Global User Skills (`/Users/abuusama/.claude/skills/`)

Medium

research/existing-patterns.md:332

Hidden file access

read ~/.claude/skills/solidity-btt-tests/CLAUDE.md

Medium

research/existing-patterns.md:337

Hidden file access

ls ~/.claude/skills/solidity-btt-tests/templates/

Medium

research/existing-patterns.md:587

Hidden file access

- `/Users/abuusama/projects/solidity/beads/.claude-plugin/agents/task-agent.md`

The snippet references hidden Claude project files or backups. This is plausible legitimate agent tooling, but it is still filesystem-sensitive configuration access that should be reviewed.

Medium

research/existing-patterns.md:591

Hidden file access

- `/Users/abuusama/.claude/skills/create-skill/SKILL.md`

Medium

research/existing-patterns.md:592

Hidden file access

- `/Users/abuusama/.claude/skills/example-skill/SKILL.md`

Medium

research/existing-patterns.md:593

Hidden file access

- `/Users/abuusama/.claude/skills/research/SKILL.md`

Medium

research/existing-patterns.md:594

Hidden file access

- `/Users/abuusama/.claude/skills/solidity-btt-tests/SKILL.md`

Medium

research/existing-patterns.md:595

Hidden file access

- `/Users/abuusama/.claude/skills/whitepaper-generator/SKILL.md`

Medium

research/slash-commands.md:386

Shell command substitution

COMMAND=$(jq -r '.tool_input.command')

Medium

research/slash-commands.md:456

Shell command substitution

FILE_PATH=$(jq -r '.tool_input.file_path')

Medium

research/slash-commands.md:460

Shell command substitution

CONTENT=$(jq -r '.tool_input.content')

Medium

research/slash-commands.md:495

Shell command substitution

FILE_PATH=$(jq -r '.tool_input.file_path')

Medium

research/slash-commands.md:498

Shell command substitution

LINT_OUTPUT=$(npx eslint "$FILE_PATH" 2>&1)

Medium

research/slash-commands.md:27

Hidden file access

- **User commands**: `~/.claude/commands/` (personal, all projects)

Medium

research/slash-commands.md:209

Hidden file access

mkdir -p ~/.claude/commands

Medium

research/slash-commands.md:210

Hidden file access

cat > ~/.claude/commands/security-review.md << 'EOF'

Medium

research/slash-commands.md:244

Hidden file access

3. **User global**: `~/.claude/settings.local.json`

Medium

research/slash-commands.md:609

Hidden file access

BACKUP_DIR="$CLAUDE_PROJECT_DIR/.claude/backups"

The snippet references hidden Claude project files or backups. This is plausible legitimate agent tooling, but it is still filesystem-sensitive configuration access that should be reviewed.

Medium

research/slash-commands.md:613

Hidden file access

cp "$CLAUDE_PROJECT_DIR/.claude/transcript.json" \

The snippet references hidden Claude project files or backups. This is plausible legitimate agent tooling, but it is still filesystem-sensitive configuration access that should be reviewed.

Medium

research/slash-commands.md:652

Hidden file access

3. **User global**: `~/.claude/settings.local.json`

Medium

research/slash-commands.md:567

Temp directory access

} > /tmp/session-context.txt

The snippet writes session context to a shared temporary path. This is likely instructional but may expose development context if copied into automation.

Medium

research/slash-commands.md:570

Temp directory access

echo "Development context loaded. See /tmp/session-context.txt"

The snippet writes session context to a shared temporary path. This is likely instructional but may expose development context if copied into automation.

Medium

SKILL.md:146-147

Ruby/shell backtick execution

- **Project-level**: `.claude/agents/` (version controlled, team-shared)

The snippet references hidden Claude project files or backups. This is plausible legitimate agent tooling, but it is still filesystem-sensitive configuration access that should be reviewed.

Medium

SKILL.md:147-155

Ruby/shell backtick execution

- **User-level**: `~/.claude/agents/` (personal agents)

Medium

SKILL.md:164-171

Ruby/shell backtick execution

**Custom agents**: Reference by name from `.claude/agents/`

The snippet references hidden Claude project files or backups. This is plausible legitimate agent tooling, but it is still filesystem-sensitive configuration access that should be reviewed.

Medium

SKILL.md:147

Hidden file access

- **User-level**: `~/.claude/agents/` (personal agents)

Medium

workflows/interview-create.md:295

Hidden file access

**B. User-level** (`~/.claude/agents/`)

Medium

workflows/quick-create.md:40

Hidden file access

~/.claude/agents/[agent-name].md

Medium

workflows/quick-create.md:55

Hidden file access

touch ~/.claude/agents/agent-name.md

Medium

workflows/quick-create.md:309

Hidden file access

│ User: ~/.claude/agents/[name].md │

Low

research/slash-commands.md:594

Hardcoded URL

curl -s https://api.openai.com/v1/chat/completions \

The snippet contains an external network endpoint in reference material. This appears legitimate documentation, but it is still a real network capability indicator.

Low

research/slash-commands.md:904

Hardcoded URL

scopes: ['https://www.googleapis.com/auth/calendar.readonly'],

The snippet contains an external network endpoint in reference material. This appears legitimate documentation, but it is still a real network capability indicator.

Low

research/slash-commands.md:969

Hardcoded URL

apiUrl: "https://api.example.com",

The snippet contains an external network endpoint in reference material. This appears legitimate documentation, but it is still a real network capability indicator.

Low

research/slash-commands.md:903

Environment variable access (dot notation)

credentials: JSON.parse(process.env.GOOGLE_CREDENTIALS),

Low

research/slash-commands.md:903

Environment variable object

credentials: JSON.parse(process.env.GOOGLE_CREDENTIALS),

Risk Factors

⚙️ External commands (50)

🌐 Network access (4)

references/advanced-features.md:312 research/slash-commands.md:594 research/slash-commands.md:904 research/slash-commands.md:969

📁 Filesystem access (50)

🔑 Env variables (6)

research/slash-commands.md:903 research/slash-commands.md:903 research/slash-commands.md:679 research/slash-commands.md:682 research/slash-commands.md:596 research/slash-commands.md:1062

Audited by: claude View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/aaronabuusama-subagent-factory/audits/11?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/aaronabuusama-subagent-factory/security.svg)](https://skillstore.io/skills/aaronabuusama-subagent-factory?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/aaronabuusama-subagent-factory?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/aaronabuusama-subagent-factory/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/aaronabuusama-subagent-factory.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

AaronAbuUsama. (2026). subagent-factory security audit report (audit version 11) [Author version unspecified]. Skillstore. https://skillstore.io/skills/aaronabuusama-subagent-factory/audits/11

BibTeX citation

@techreport{aaronabuusama-aaronabuusama-subagent-factory-2026,
  author = {AaronAbuUsama},
  title = {subagent-factory security audit report (audit version 11)},
  institution = {Skillstore},
  year = {2026},
  number = {11},
  url = {https://skillstore.io/skills/aaronabuusama-subagent-factory/audits/11},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "subagent-factory security audit report (audit version 11)"
version: "unspecified"
type: report
authors:
  - name: "AaronAbuUsama"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/aaronabuusama-subagent-factory/audits/11"
identifiers:
  - type: other
    value: "skillstore:aaronabuusama-subagent-factory:audit:11"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Create a focused review agent

Define a subagent that reviews code for a specific language, framework, or quality standard.

Standardize team automation

Build project-level agents that help a team run the same workflows consistently.

Learn Claude Code agent design

Study frontmatter, tool scoping, and prompt structure before creating custom agents.

Try These Prompts

Create a simple agent

Create a Claude Code subagent for reviewing TypeScript pull requests. Keep the tools limited to reading files and searching the codebase.

Design an agent from requirements

Help me design a subagent for investigating flaky tests. Ask any needed questions, then propose the name, description, tools, and prompt.

Refine an existing agent

Review this agent definition and make it safer and more focused. Reduce unnecessary tools and clarify when the agent should be used.

Build a multi-agent workflow set

Create three coordinated Claude Code subagents for planning, implementation review, and test diagnosis. Define boundaries so their responsibilities do not overlap.

Best Practices

Grant each subagent only the tools required for its task.
Write activation descriptions that clearly state when the agent should and should not run.
Prefer project-level agents for team workflows that should be reviewed in version control.

Avoid

Do not create broad agents that can edit, run commands, and manage external systems without a narrow purpose.
Do not place sensitive credentials or private project details in reusable agent prompts.
Do not use user-level agent paths when the workflow should be shared and reviewed by a team.