Skills team-dev
πŸ“¦

team-dev

Content revision r2 High Risk βš™οΈ External commands

Coordinate Parallel Development Agents

Large coding tasks become slow when independent work is handled sequentially. This skill groups dependencies, dispatches isolated agents, verifies results, and integrates completed branches.

Supports: Claude Codex Code(CC)
⚠️ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "team-dev" from https://skillstore.io/skills/cubha-team-dev.md and its manifest at https://skillstore.io/api/skills/cubha-team-dev/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Test it

Using "team-dev". Plan authentication API, profile page, and shared user types.

Expected outcome:

The shared user types form the first group. The authentication API and profile page follow in a parallel second group.

Using "team-dev". Implement four independent validation functions with TDD.

Expected outcome:

  • Four tasks qualify for TDD because each has deterministic input and output.
  • Each agent creates a valid failing test before implementation.
  • Integration continues only after all validation tests pass.

Using "team-dev". Run a dry analysis for a dashboard migration.

Expected outcome:

The skill returns dependency groups, target files, and blocking relationships without modifying the repository.

Security Audit

High Risk
v3 β€’ 7/23/2026 Open versioned report

Four command-execution findings are confirmed because the workflow runs repository-provided tests and verification scripts. Sixteen Markdown backtick findings and four entropy findings are false positives, but prompt propagation and automatic integration create additional security concerns.

4
Files scanned
549
Lines analyzed
4
Review items
0
False positives ignored

Confirmed security concerns (3)

High
Prompt Injection Attempt Detected
The prompt template states "CONSISTENCY LOCK β€” OVERRIDE DEFAULT VARIATION DIRECTIVES." It is placed at the top of another skill prompt and claims precedence over existing directives.
The source contains explicit override language and directs the orchestrator to inject it into a downstream prompt.
High
Untrusted Repository Instructions Propagated to Agents
The workflow reads project rule files such as CLAUDE.md and inserts their contents into subagent prompts without validation or a trust boundary.
Both collection and direct prompt insertion are explicitly documented, and no filtering or precedence defense is specified.
Medium
Automatic Integration of Agent-Generated Branches
The workflow merges agent branches into the main branch and may attempt conflict resolution before requesting user judgment.
The merge commands and automatic conflict-resolution sequence are explicit, creating a clear code-integrity risk without a mandatory review gate.
Capability review items (4)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
Ruby/shell backtick execution
1. λ―Έκ΅¬ν˜„ λ™μž‘μ— λŒ€ν•œ λ‹¨μœ„ ν…ŒμŠ€νŠΈ(`*.test.*`)λ₯Ό λ¨Όμ € μž‘μ„± β†’ μ‹€ν–‰ β†’ **RED 확인**
The cited range directs an agent to execute tests and then run a project verification script. Repository test and build commands can execute untrusted project code.
Medium
Ruby/shell backtick execution
4. κ΅¬ν˜„ μ™„λ£Œ ν›„ ν”„λ‘œμ νŠΈ 검증 μŠ€ν¬λ¦½νŠΈκ°€ 있으면 μ‹€ν–‰ν•˜λΌ (`bash verify.sh`Β·`npm test`Β·`npm run build` λ“±). μ—†μœΌλ©΄ 정적 검증 단계λ₯Ό μƒλž΅ν•œ
The instruction explicitly runs bash verify.sh, npm test, or npm run build. These repository-controlled commands can execute arbitrary local scripts.
Medium
Ruby/shell backtick execution
5. κ΅¬ν˜„ μ™„λ£Œ ν›„ ν”„λ‘œμ νŠΈ 검증 μŠ€ν¬λ¦½νŠΈκ°€ 있으면 μ‹€ν–‰ν•˜λΌ (`bash verify.sh`Β·`npm test` λ“±).
The team-mode prompt explicitly requires execution of repository verification commands. No inspection, sandboxing, or confirmation requirement is stated.
Medium
Ruby/shell backtick execution
- **검증 슀크립트(선택)** β€” `verify.sh`Β·`npm test`Β·`npm run build` λ“± ν”„λ‘œμ νŠΈ 검증 μˆ˜λ‹¨μ΄ 있으면 각 SubTask μ™„λ£Œ ν›„ 및 톡합 μ‹œ μ‹€
The line instructs the workflow to execute repository verification commands after subtasks and integration. Shell and package scripts can run untrusted project code.
Audited by: codex View Audit History β†’
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/cubha-team-dev/audits/3?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/cubha-team-dev/security.svg)](https://skillstore.io/skills/cubha-team-dev?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/cubha-team-dev?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/cubha-team-dev/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/cubha-team-dev.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA Β· BibTeX Β· CFF)

APA citation

cubha. (2026). team-dev security audit report (audit version 3) [Author version unspecified]. Skillstore. https://skillstore.io/skills/cubha-team-dev/audits/3

BibTeX citation

@techreport{cubha-cubha-team-dev-2026, author = {cubha}, title = {team-dev security audit report (audit version 3)}, institution = {Skillstore}, year = {2026}, number = {3}, url = {https://skillstore.io/skills/cubha-team-dev/audits/3}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "team-dev security audit report (audit version 3)" version: "unspecified" type: report authors: - name: "cubha" date-released: "2026-07-23" url: "https://skillstore.io/skills/cubha-team-dev/audits/3" identifiers: - type: other value: "skillstore:cubha-team-dev:audit:3" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
55
Architecture
85
Maintainability
87
Content
65
Community
83
Spec Compliance

What You Can Build

Build Independent Product Features

Split a large feature into isolated modules and implement independent modules concurrently.

Coordinate a Repository Migration

Group migration tasks by shared files and dependencies before assigning work to separate agents.

Apply TDD Across Parallel Tasks

Identify deterministic logic tasks, create failing tests first, and verify integrated results.

Try These Prompts

Plan Parallel Work
Analyze these subtasks for dependencies and show parallel groups without implementing anything: {subtasks}. Use dry-run mode.
Implement a Feature
Implement {feature} with team development. Separate the work into clear subtasks, show the dependency groups, and wait for approval.
Run a TDD Workflow
Implement these logic tasks in parallel with TDD enabled: {subtasks}. Confirm valid failing tests before writing implementation code.
Orchestrate an Advanced Migration
Coordinate {migration_goal} across {modules}. Preserve project conventions, map cross-module dependencies, limit agents to five, and stop automatic progress after any verification failure.

Best Practices

  • Use dry-run mode first and review dependency groups before implementation.
  • Assign separate files to parallel tasks and keep shared interfaces in earlier groups.
  • Review repository scripts and branch diffs before verification or integration.

Avoid

  • Do not parallelize tasks that modify the same files or depend on unfinished interfaces.
  • Do not use automatic mode with untrusted repository instructions or scripts.
  • Do not treat a successful merge as proof that behavior is correct.

Frequently Asked Questions

Does this skill require Git?
Yes. It uses Git worktrees to isolate each agent and expects an initialized repository.
How many agents can run in parallel?
The workflow limits each parallel group to five agents.
Can I preview the plan without changing files?
Yes. Dry-run mode performs dependency analysis and group classification without implementation.
Does every task use TDD?
No. TDD applies only when enabled and when a task meets the deterministic logic and test-runner criteria.
What happens when verification fails?
The workflow retries fixes up to three times and disables automatic progression after an integration failure.
Does Agent Teams mode work everywhere?
No. It requires the experimental Claude Code Agent Teams feature. The workflow otherwise uses standard subagents.

Developer Details

Author

cubha

License

MIT

Skillstore revision

r2

Version notice

The author did not declare a version.

Ref

c43861a65bb95efcae259cd161c9d6f4dc7eec6f

Maintenance freshness

7/24/2026

Usage

0 downloads Β· 1 views

File structure

πŸ“„ phase-analyze.md

πŸ“„ phase-dispatch.md

πŸ“„ phase-verify.md

πŸ“„ SKILL.md

More from cubha

View all
View all