packages/skills-catalog/skills/(creation)/subagent-creator/SKILL.md
Guide for creating AI subagents with isolated context for complex multi-step workflows. Use when users want to create a subagent, specialized agent, verifier, debugger, or orchestrator that requires isolated context and deep specialization. Works with any agent that supports subagent delegation. Triggers on "create subagent", "new agent", "specialized assistant", "create verifier". Do NOT use for Cursor-specific subagents (use cursor-subagent-creator instead).
npx skillsauth add tech-leads-club/agent-skills subagent-creatorInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
This skill provides guidance for creating effective, agent-agnostic subagents.
Subagents are specialized assistants that an AI agent can delegate tasks to. Characteristics:
Is the task complex with multiple steps?
├─ YES → Does it require isolated context?
│ ├─ YES → Use SUBAGENT
│ └─ NO → Use SKILL
│
└─ NO → Use SKILL
Use Subagents for:
Use Skills for:
A subagent is typically a markdown file with frontmatter metadata:
---
name: agent-name
description: Description of when to use this subagent.
model: inherit # or fast, or specific model ID
readonly: false # true to restrict write permissions
---
You are an [expert in X].
When invoked:
1. [Step 1]
2. [Step 2]
3. [Step 3]
[Detailed instructions about expected behavior]
Report [type of expected result]:
- [Output format]
- [Metrics or specific information]
Unique identifier. Use kebab-case.
name: security-auditor
CRITICAL for automatic delegation. Explains when to use this subagent.
Good descriptions:
Phrases that encourage automatic delegation:
model: inherit # Uses same model as parent (default)
model: fast # Uses fast model for quick tasks
readonly: true # Restricts write permissions
Define:
Template:
You are an [expert in X] specialized in [Y].
When invoked:
1. [First action]
2. [Second action]
3. [Third action]
[Detailed instructions about approach]
Report [type of result]:
- [Specific format]
- [Information to include]
- [Metrics or criteria]
[Philosophy or principles to follow]
Purpose: Independently validates that completed work actually works.
---
name: verifier
description: Validates completed work. Use after tasks are marked done.
model: fast
---
You are a skeptical validator.
When invoked:
1. Identify what was declared as complete
2. Verify the implementation exists and is functional
3. Execute tests or relevant verification steps
4. Look for edge cases that may have been missed
Be thorough. Report:
- What was verified and passed
- What is incomplete or broken
- Specific issues to address
Purpose: Expert in root cause analysis.
---
name: debugger
description: Debugging specialist. Use when encountering errors or test failures.
---
You are a debugging expert.
When invoked:
1. Capture the error message and stack trace
2. Identify reproduction steps
3. Isolate the failure location
4. Implement minimal fix
5. Verify the solution works
For each issue, provide:
- Root cause explanation
- Evidence supporting the diagnosis
- Specific code fix
- Testing approach
Purpose: Security expert auditing code.
---
name: security-auditor
description: Security specialist. Use for auth, payments, or sensitive data.
---
You are a security expert.
When invoked:
1. Identify security-sensitive code paths
2. Check for common vulnerabilities
3. Confirm secrets are not hardcoded
4. Review input validation
Report findings by severity:
- **Critical** (must fix before deploy)
- **High** (fix soon)
- **Medium** (address when possible)
- **Low** (suggestions)
Purpose: Code review with focus on quality.
---
name: code-reviewer
description: Code review specialist. Use when changes are ready for review.
---
You are a code review expert.
When invoked:
1. Analyze the code changes
2. Check readability, performance, patterns, error handling
3. Identify code smells and potential bugs
4. Suggest specific improvements
Report:
**✅ Approved / ⚠️ Approved with caveats / ❌ Changes needed**
**Issues Found:**
- **[Severity]** [Location]: [Issue]
- Suggestion: [How to fix]
Before finalizing:
When creating a subagent:
✅ Subagent created successfully!
📁 Location: .agent/subagents/[name].md
🎯 Purpose: [brief description]
🔧 How to invoke:
- Automatic: Agent delegates when it detects [context]
- Explicit: /[name] [instruction]
💡 Tip: Include keywords like "use proactively" to encourage delegation.
development
Generate Excalidraw diagrams from natural language descriptions. Outputs .excalidraw JSON files openable in Excalidraw. Use when asked to "create a diagram", "make a flowchart", "visualize a process", "draw a system architecture", "create a mind map", "generate an Excalidraw file", "draw an ER diagram", "create a sequence diagram", or "make a class diagram". Supports flowcharts, relationship diagrams, mind maps, architecture, DFD, swimlane, class, sequence, and ER diagrams. Can use icon libraries (AWS, GCP, etc.) when set up. Do NOT use for code architecture analysis (use the architecture skills), Mermaid diagram rendering (use mermaid-studio), or non-visual documentation (use docs-writer).
tools
Browser debugging, performance profiling, and automation via Chrome DevTools MCP. Use when user says "debug this page", "take a screenshot", "check network requests", "profile performance", "inspect console errors", or "analyze page load". Do NOT use for full E2E test suites (use playwright-skill) or non-browser debugging.
development
Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model. Use when the user asks to threat model a codebase or path, enumerate threats or abuse paths, or perform AppSec threat modeling. Do NOT use for general architecture summaries, code review, security best practices (use security-best-practices), or non-security design work.
development
Analyze git repositories to build a security ownership topology (people-to-file), compute bus factor and sensitive-code ownership, and export CSV/JSON for graph databases and visualization. Use when the user explicitly wants a security-oriented ownership or bus-factor analysis grounded in git history (for example: orphaned sensitive code, security maintainers, CODEOWNERS reality checks for risk, sensitive hotspots, or ownership clusters). Do NOT use for general maintainer lists, non-security ownership questions, or threat modeling (use security-threat-model).