【学习笔记】Claude Code Agents 详解

主会话
  ├── 用户请求：审查所有文件
  ├── Claude 识别：这是审查任务
  ├── 启动 subagent（agents/reviewer.md）
  │     ├── 只读工具：Read、Grep、Glob
  │     ├── 模型：sonnet
  │     └── 独立上下文，不影响主会话
  └── 收集 subagent 结果，汇报给用户

---
name: reviewer
description: Review code changes for quality and security issues.
---

## Task

Review the code changes provided. Focus on:

1. Security vulnerabilities
2. Performance issues
3. Code style consistency

Report findings as a structured list.

---
name: security-auditor
description: Deep security audit of code changes, checking for OWASP Top 10 and common vulnerabilities.
tools:
  - Read
  - Grep
  - Glob
  - WebSearch
model: sonnet
maxTurns: 30
effort: high
---

## Security Audit

Perform a comprehensive security audit covering:

### OWASP Top 10 Check
- Injection vulnerabilities
- Broken authentication patterns
- Sensitive data exposure
- XML External Entities (XXE)
- Broken access control

### Report Format
For each finding:
- Severity: Critical / High / Medium / Low
- Location: file:line
- Description
- Recommendation

# 用 Sonnet 做平衡任务
model: sonnet

# 用 Haiku 做快速分类
model: haiku

# 用 Opus 做深度分析
model: opus

# 在独立 worktree 中运行，文件修改不影响主工作目录
isolation: worktree

任务：找到所有使用 deprecated API 的文件
  ├── Explore agent 启动
  │     ├── 只能读，不能改
  │     ├── 使用 Glob/Grep/Read 广泛搜索
  │     └── 汇总搜索结论
  └── 主会话拿到结论，决定如何修改

任务：设计用户认证模块
  ├── Plan agent 启动
  │     ├── 阅读现有代码结构
  │     ├── 分析依赖关系
  │     └── 输出分步实现计划
  └── 主会话按计划执行

# skills/review/SKILL.md
---
description: Deep code review
context: fork
agent: general-purpose
---

Perform a thorough code review of the current changes.

agents/
├── reviewer.md      → Claude 可自动调用
├── security.md      → Claude 可自动调用
└── migrator.md      → Claude 可自动调用

{
  "name": "my-plugin",
  "agents": ["./custom/agents/reviewer.md"]
}

# 好：只读任务用 Explore
---
name: doc-searcher
description: Search documentation for relevant information.
tools:
  - Read
  - Grep
  - Glob
---

# 不好：只读任务给了全部工具
---
name: doc-searcher
description: Search documentation.
---

# 好
description: Deep security audit of code changes, checking for OWASP Top 10 and common vulnerabilities. Use when reviewing code for security issues.

# 不好
description: Security audit.

---
name: researcher
description: Research a topic thoroughly.
maxTurns: 20
---

---
name: migrator
description: Migrate code from v1 API to v2 API.
isolation: worktree
tools:
  - Read
  - Edit
  - Write
  - Grep
  - Glob
---

---
name: reviewer
description: Review code quality.
tools:
  - Read
  - Grep
  - Glob
---

## Review the code

For each finding, output:
- **Severity**: Critical / High / Medium / Low
- **File**: path/to/file:line
- **Issue**: one-line description
- **Fix**: recommended fix

If no issues found, output: "No issues found."

agents/
└── api-diagnostic.md    → 诊断 GLM/Z.ai API 连接问题的 agent
                         → 只读工具 + WebSearch
                         → 检查 API key、URL、缓存状态