007
無料Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project.
日本語の概要は準備中です。原文の説明を表示しています。
Guide for authoring specialized AI agents. Use when creating, updating, or improving agents, choosing models, defining focus areas, configuring tools, or learning agent best practices.
インストールする前に、エージェントに与えられる指示の中身を確認できます。
Advanced agent authoring guidance:
Agents are specialized AI assistants that run in separate subprocesses with focused expertise. They have:
When to use agents:
Focus areas define what the agent is expert in. They should be:
Specific, not generic:
Concrete, with examples:
5-15 focus areas that cover the agent's expertise comprehensively.
Example from evaluator agent:
## Focus Areas
- YAML Frontmatter Validation
- Markdown Structure
- Tool Permissions
- Description Quality
- File Organization
- Progressive Disclosure
- Integration Patterns
Sonnet (default choice for most agents):
Haiku (for simple, fast tasks):
Opus (for complex reasoning):
Decision guide:
Why restrict tools:
Common tool patterns:
Read-only analyzer:
allowed_tools:
- Read
- Glob
- Grep
- Bash
Examples: evaluator, audit-skill
Code generator/modifier:
allowed_tools:
- Read
- Edit
- Write
- Grep
- Glob
- Bash
Examples: test-runner
Minimal/focused:
allowed_tools:
- Read
- AskUserQuestion
Example: When agent only needs to read and ask questions
If unspecified: Agent inherits all tools from parent (usually not desired)
default (most common):
acceptEdits (for editing workflows):
plan (for planning agents):
Most agents use default - only use others when you have a specific workflow need.
Agent hooks are lifecycle hooks defined in YAML frontmatter, scoped to that specific agent.
When to use agent hooks:
When to use settings.json hooks instead:
Available events:
| Event | Trigger | Use Case |
|---|---|---|
PreToolUse | Before agent uses tool | Validation, blocking, logging |
PostToolUse | After tool completes | Formatting, notifications |
Stop | Agent finishes | Cleanup, notifications |
Configuration syntax:
---
name: code-reviewer
description: Review code with automatic linting
hooks:
PreToolUse:
- matcher: "Bash"
hooks:
- type: command
command: "./scripts/validate-command.sh"
PostToolUse:
- matcher: "Edit|Write"
hooks:
- type: command
command: "./scripts/run-linter.sh"
timeout: 10
---
Key points:
"Edit|Write", "Bash", "*")Three proven patterns for building effective agents. Each pattern includes complete templates you can copy and customize.
📄 See design-patterns.md for detailed templates
Quick overview:
Per Claude Code specification, agents are single files only:
agents/
├── code-reviewer.md # Single file agent
├── bash-expert.md # Single file agent
└── security-auditor.md # Single file agent
No subdirectories or reference files supported.
| Need | Use |
|---|---|
| Reference files / progressive disclosure | Skill |
| Single-file focused capability | Agent |
| Large documentation (>500 lines) | Skill (can split content) |
If you need reference files, convert to a skill instead:
skills/evaluator/
├── SKILL.md # Main skill file
├── evaluation-criteria.md # Reference file
└── examples.md # Reference file
📄 See ~/.claude/docs/agent-vs-skill-structure.md for details
Since agents must be single files:
Start by clarifying:
Questions to ask:
Use AskUserQuestion to clarify ambiguities before proceeding.
Check for existing agents:
ls -la ~/.claude/agents/
Look for similar agents that might overlap.
Model selection:
Tool selection:
Permission mode:
default unless you have specific needGuidelines:
Good examples (from evaluator):
Bad examples:
This section explains HOW the agent works:
Include:
Example from evaluator:
## Evaluation Framework
### Correctness Criteria
- YAML frontmatter with required fields
- Valid model value
- Name matches filename
...
## Evaluation Process
### Step 1: Identify Extension Type
...
### Step 2: Apply Type-Specific Validation
...
Requirements:
Formula: [What it does] for [use cases]. Expert/Use when [triggers]. [Key features]
Good example:
description: Master of defensive Bash scripting for production automation, CI/CD pipelines, and system utilities. Expert in safe, portable, and testable shell scripts.
Bad example:
description: Helps with bash scripts
File location: ~/.claude/agents/agent-name.md
Filename should match name in frontmatter.
Basic structure:
---
name: agent-name
description: [comprehensive description with triggers]
model: sonnet
allowed_tools:
- Read
- [other tools]
---
## Focus Areas
- [Specific area 1]
- [Specific area 2]
...
## Approach
[How the agent works, methodologies, processes]
## [Optional Additional Sections]
[Examples, best practices, output formats, etc.]
Test invocation:
Validate with /audit-agent:
/audit-agent agent-name
This will check:
Choosing the right customization type is critical. Each has distinct characteristics and use cases.
📄 See agent-decision-guide.md for agent-specific decision framework
📄 See when-to-use-what.md for detailed decision guide (shared)
Quick guide:
Real-world examples showing what makes a good agent. Each example is analyzed to explain why it works well.
📄 See examples.md for detailed analysis
Examples covered:
Each example includes the full frontmatter, focus areas, and analysis of what makes it effective.
For detailed standards and validation:
~/.claude/agents/agent-name.md/audit-agent commandSee audit-coordinator skill for comprehensive standards.
This skill is part of the authoring skill family:
For validation, use the corresponding audit skills:
Creating a new agent:
~/.claude/agents/agent-name.md/audit-agent agent-nameまだレビューはありません。使ってみた感想をお寄せください。
概要と使いどころ
Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project.
日本語の概要は準備中です。原文の説明を表示しています。
Guides the creation of agile user stories and Gherkin feature files. Use when the user wants to create a user story, write acceptance criteria, define Gherkin scenarios, or author BDD feature files. This should trigger for requests such as Create a user story; Write a user story; I need to write a user story. Part of cursor-rules-java project
日本語の概要は準備中です。原文の説明を表示しています。
Facilitates conversational discovery to create Architectural Decision Records (ADRs) for non-functional requirements using the ISO/IEC 25010:2023 quality model. Use when the user wants to document quality attributes, NFR decisions, security/performance/scalability architecture, or design systems with measurable quality criteria. This should trigger for requests such as Create ADR for Non-functional requirements; Document Non-functional requirements; Capture Non-functional requirements; Generate Non-functional requirements in an ADR. Part of cursor-rules-java project
日本語の概要は準備中です。原文の説明を表示しています。
Run a health check on an existing project: dependency audit, security scan, test runner detection, CI/CD evaluation, and missing configuration analysis. Maps the three execution gates (pre/in/post) from /10x-bootstrapper to an assessment framework for existing codebases. Reads optional context/foundation/stack-assessment.md from /10x-stack-assess to focus checks on identified gaps. Writes context/foundation/health-check.md with findings, prioritized fixes, and an agent-readiness verdict. Use when the user has an existing project and wants to verify its health before working with an agent. Trigger phrases: "health check", "check my project", "audit my project", "is my project healthy", "sprawdź projekt", "audyt projektu", "health-check", "project health". Use AFTER /10x-stack-assess (brownfield chain), BEFORE agent onboarding (m1-l4).
日本語の概要は準備中です。原文の説明を表示しています。
You MUST use this when building projects end-to-end. Orchestrates all 12 team roles — automatically switches between CTO, architect, PM, engineers, SRE, security, DBA, QA, and EM based on the current phase of work. Starts with brainstorming before any implementation.
日本語の概要は準備中です。原文の説明を表示しています。
Use when you need to add or configure Maven plugins in your pom.xml — including quality tools (enforcer, surefire, failsafe, jacoco, pitest, spotbugs, pmd), security scanning (OWASP), code formatting (Spotless), version management, container image build (Jib), build information tracking, and benchmarking (JMH) — through a consultative, modular step-by-step approach that only adds what you actually need. This should trigger for requests such as Add Maven plugins in pom.xml; Improve Maven plugins in pom.xml. Part of cursor-rules-java project
日本語の概要は準備中です。原文の説明を表示しています。