Multi-agent development team workflow skill. Use when coordinating complex development tasks requiring multiple specialized roles - PM, Architect, Developer,...
Security Analysis
medium confidenceThe skill's workflow and instructions match its stated purpose, but the runtime guidance includes executing remote install scripts (PowerShell piped to iex) and vague file/log access patterns that are disproportionate and risky without further safeguards.
The name/description (multi-agent development workflow) aligns with the content: spawning PM/Architect/Developer/Tester/Debugger agents and orchestrating development phases. Examples and tool choices are coherent for a development orchestration skill.
SKILL.md instructs the agent to spawn sub-agents and to operate on code, logs, and local paths (e.g., identify_modules("./legacy-code"), <logs attached>, fetch_pr). That is reasonable for a dev workflow, but the documentation also instructs installing and running remote installers (PowerShell: irm https://... | iex), which directs execution of arbitrary remote code — outside the narrow scope of 'workflow guidance' and a significant operational risk. Instructions are also somewhat vague about what environment the agent expects (what sessions_spawn/fetch_pr actually do and what permissions they require).
Although the registry has no install spec, the included tools guide explicitly recommends running remote PowerShell install commands that pipe downloaded scripts into iex (irm https://claude.ai/install.ps1 | iex and irm https://code.kimi.com/install.ps1 | iex). Executing remote installer scripts via piping to a shell is a high-risk installation mechanism. One of the URLs (claude.ai) is a known vendor domain; the other (code.kimi.com) is not verifiable here. The skill should not recommend or assume running arbitrary remote installers without verification.
The skill declares no required env vars or credentials, and this is consistent with the registry metadata. However, the instructions reference per-user config files (~/.claude/settings.json and ~/.kimi/config.toml) and advise system prompts, and they assume external tooling that will likely require credentials or tokens at install/run time. The absence of declared required credentials means the skill does not make explicit what secrets/tools the operator must provide.
always is false and the skill does not request system-wide config modification beyond per-user tool config files. It does not claim to modify other skills or force inclusion. No persistence/privilege escalation is declared.
Guidance
This skill appears to implement a reasonable multi-agent dev workflow, but review the following before installing or following its instructions: - Do not run remote installer scripts piped directly into a shell (irm | iex or curl | sh). That executes code fetched from the network with no local review — replace with official package installers, verified releases, or manual review of the script first. - Verify the installer domains (e.g., claude.ai is Anthropic's domain; confirm code.kimi.com is the legitimate vendor). If you can't confirm, avoid installing that CLI. - The skill assumes the agent can read code, logs, and local project directories. Confirm what access your agent runtime grants and limit it to only the repositories/paths needed. - The SKILL.md references helper functions (sessions_spawn, fetch_pr, identify_modules). Confirm these are safe built-ins in your agent environment and understand their permissions and network behavior. - Because the skill doesn't declare any credentials but suggests tools that likely require API keys/tokens, prepare to provide credentials separately and audit where those tokens are stored/used. - If you plan to allow autonomous invocation, consider restricting it while you test the skill in a sandboxed environment and verify the toolchain and installer sources. If you want a safer assessment, provide: (1) confirmation/verified URLs for any recommended installers, (2) documentation for sessions_spawn/fetch_pr runtime APIs, and (3) whether this agent will have direct filesystem or network access in your deployment — that information would raise confidence to high or allow targeted remediation steps.
Latest Release
v1.0.0
Initial release of "class_seven" skill: multi-agent development team workflow. - Introduces a structured, role-based orchestration for complex development tasks using specialized sub-agents (PM, Architect, Developer, Tester, Debugger). - Supports multiple workflow phases: planning, architecture/design, implementation, testing, debugging, and integration. - Includes a tool selection matrix to guide optimal agent/tool pairing based on task type. - Provides quick commands for different execution modes (full team, sprint, debug, review). - Details best practices and error handling procedures to ensure robust team collaboration and task delivery.
More by @russellfei
Published by @russellfei on ClawHub
