Claude Code, Skill
Sub Agents Skills
Run agent definitions as sub-agents across multiple AI coding CLIs.
Compatibility: Not stated.
Grade C
One Medium finding. Read the findings before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 2272da911622.
INSTALL_REMOTE_SCRIPT
Why this grade
- INSTALL_REMOTE_SCRIPT Medium
Fetches a script from the network and runs it (a pipe to a shell, or an install hook with a URL).
install.sh, line 5
# Usage: curl -fsSL https://raw.githubusercontent.com/shinpr/sub-agents-skills/main/install.sh | bash -s -- --target <path>
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
If you think this grade is wrong, email [email protected] with the entry link and your evidence. We aim to acknowledge within two working days and decide within seven. If we confirm an error, we aim to correct it within 24 hours of confirming it. These are aims, not guarantees.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
plugins/runner/skills/sub-agents/scripts/_builder.py, line 270
completed = subprocess.run(
plugins/runner/skills/sub-agents/scripts/_executor.py, line 170
def _spawn_reader(process: subprocess.Popen[str]) -> queue.Queue[str | None]:
plugins/runner/skills/sub-agents/scripts/_executor.py, line 208
def _drive_process(process: subprocess.Popen[str], cli: str, timeout_ms: int) -> AgentResponse:
Show more
plugins/runner/skills/sub-agents/scripts/_executor.py, line 309
process = subprocess.Popen( # noqa: S603
plugins/runner/skills/sub-agents/scripts/_executor.py, line 370
shutil.rmtree(temp_dir, ignore_errors=True)
scripts/sync_plugin.py, line 38
shutil.rmtree(PLUGIN_SKILL)
skills/sub-agents/scripts/_builder.py, line 270
completed = subprocess.run(
skills/sub-agents/scripts/_executor.py, line 170
def _spawn_reader(process: subprocess.Popen[str]) -> queue.Queue[str | None]:
skills/sub-agents/scripts/_executor.py, line 208
def _drive_process(process: subprocess.Popen[str], cli: str, timeout_ms: int) -> AgentResponse:
skills/sub-agents/scripts/_executor.py, line 309
process = subprocess.Popen( # noqa: S603
skills/sub-agents/scripts/_executor.py, line 370
shutil.rmtree(temp_dir, ignore_errors=True)
Install and update
Serious
install fetches a script from the network. The docs document an installer that pipes a download into a shell.
INSTALL_REMOTE_SCRIPT INSTALL_DOCUMENTED_INSTALLER
install.sh, line 5
# Usage: curl -fsSL https://raw.githubusercontent.com/shinpr/sub-agents-skills/main/install.sh | bash -s -- --target <path>
install.sh, line 29
echo " curl -fsSL $REPO_URL/raw/main/install.sh | bash -s -- --target ~/.claude/skills"
README.de.md, line 66
curl -fsSL https://raw.githubusercontent.com/shinpr/sub-agents-skills/main/install.sh | bash -s -- --target ~/.cursor/skills
Show more
README.de.md, line 69
curl -fsSL https://raw.githubusercontent.com/shinpr/sub-agents-skills/main/install.sh | bash -s -- --target .github/skills
README.de.md, line 72
curl -fsSL https://raw.githubusercontent.com/shinpr/sub-agents-skills/main/install.sh | bash -s -- --target ~/.gemini/skills
README.de.md, line 532
- Claude Code: `curl -fsSL https://claude.ai/install.sh | bash`
README.de.md, line 533
- Cursor CLI: `curl https://cursor.com/install -fsS | bash`
README.de.md, line 534
- Grok Build: `curl -fsSL https://x.ai/cli/install.sh | bash`
README.de.md, line 535
- Google Antigravity: `curl -fsSL https://antigravity.google/cli/install.sh | bash`
README.de.md, line 538
- MiniMax Code: `curl -fsSL https://filecdn.minimax.chat/public/install.sh | bash`
README.es.md, line 66
curl -fsSL https://raw.githubusercontent.com/shinpr/sub-agents-skills/main/install.sh | bash -s -- --target ~/.cursor/skills
README.es.md, line 69
curl -fsSL https://raw.githubusercontent.com/shinpr/sub-agents-skills/main/install.sh | bash -s -- --target .github/skills
README.es.md, line 72
curl -fsSL https://raw.githubusercontent.com/shinpr/sub-agents-skills/main/install.sh | bash -s -- --target ~/.gemini/skills
README.es.md, line 532
- Claude Code: `curl -fsSL https://claude.ai/install.sh | bash`
README.es.md, line 533
- Cursor CLI: `curl https://cursor.com/install -fsS | bash`
README.es.md, line 534
- Grok Build: `curl -fsSL https://x.ai/cli/install.sh | bash`
README.es.md, line 535
- Google Antigravity: `curl -fsSL https://antigravity.google/cli/install.sh | bash`
README.es.md, line 538
- MiniMax Code: `curl -fsSL https://filecdn.minimax.chat/public/install.sh | bash`
README.md, line 66
curl -fsSL https://raw.githubusercontent.com/shinpr/sub-agents-skills/main/install.sh | bash -s -- --target ~/.cursor/skills
README.md, line 69
curl -fsSL https://raw.githubusercontent.com/shinpr/sub-agents-skills/main/install.sh | bash -s -- --target .github/skills
README.md, line 72
curl -fsSL https://raw.githubusercontent.com/shinpr/sub-agents-skills/main/install.sh | bash -s -- --target ~/.gemini/skills
README.md, line 554
- Claude Code: `curl -fsSL https://claude.ai/install.sh | bash`
README.md, line 555
- Cursor CLI: `curl https://cursor.com/install -fsS | bash`
README.md, line 556
- Grok Build: `curl -fsSL https://x.ai/cli/install.sh | bash`
README.md, line 557
- Google Antigravity: `curl -fsSL https://antigravity.google/cli/install.sh | bash`
README.md, line 560
- MiniMax Code: `curl -fsSL https://filecdn.minimax.chat/public/install.sh | bash`
README.ru.md, line 66
curl -fsSL https://raw.githubusercontent.com/shinpr/sub-agents-skills/main/install.sh | bash -s -- --target ~/.cursor/skills
README.ru.md, line 69
curl -fsSL https://raw.githubusercontent.com/shinpr/sub-agents-skills/main/install.sh | bash -s -- --target .github/skills
README.ru.md, line 72
curl -fsSL https://raw.githubusercontent.com/shinpr/sub-agents-skills/main/install.sh | bash -s -- --target ~/.gemini/skills
README.ru.md, line 530
- Claude Code: `curl -fsSL https://claude.ai/install.sh | bash`
README.ru.md, line 531
- Cursor CLI: `curl https://cursor.com/install -fsS | bash`
README.ru.md, line 532
- Grok Build: `curl -fsSL https://x.ai/cli/install.sh | bash`
README.ru.md, line 533
- Google Antigravity: `curl -fsSL https://antigravity.google/cli/install.sh | bash`
README.ru.md, line 536
- MiniMax Code: `curl -fsSL https://filecdn.minimax.chat/public/install.sh | bash`
README.zh-CN.md, line 66
curl -fsSL https://raw.githubusercontent.com/shinpr/sub-agents-skills/main/install.sh | bash -s -- --target ~/.cursor/skills
README.zh-CN.md, line 69
curl -fsSL https://raw.githubusercontent.com/shinpr/sub-agents-skills/main/install.sh | bash -s -- --target .github/skills
README.zh-CN.md, line 72
curl -fsSL https://raw.githubusercontent.com/shinpr/sub-agents-skills/main/install.sh | bash -s -- --target ~/.gemini/skills
README.zh-CN.md, line 527
- Claude Code：`curl -fsSL https://claude.ai/install.sh | bash`
README.zh-CN.md, line 528
- Cursor CLI：`curl https://cursor.com/install -fsS | bash`
README.zh-CN.md, line 529
- Grok Build：`curl -fsSL https://x.ai/cli/install.sh | bash`
README.zh-CN.md, line 530
- Google Antigravity：`curl -fsSL https://antigravity.google/cli/install.sh | bash`
README.zh-CN.md, line 533
- MiniMax Code：`curl -fsSL https://filecdn.minimax.chat/public/install.sh | bash`
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
install.sh, line 74
# Check if running from curl (no local skills directory)
Secrets
Note
reads an environment variable.
SECRETS_ENV_READ
plugins/runner/skills/sub-agents/scripts/_executor.py, line 59
cursor_api_key = os.environ.get("CURSOR_API_KEY")
skills/sub-agents/scripts/_executor.py, line 59
cursor_api_key = os.environ.get("CURSOR_API_KEY")
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 2272da911622. can delete files. install fetches a script from the network. can reach a host that is not written as a fixed address. reads an environment variable.
Date and source
Date checked:
github.com
Commit graded: 2272da9116224a51845c41c0f9cd91ede38ab5cb
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.