How do I install the Subagent Safety skill?

Run npx skillmds@latest add matteobortolazzo/subagent-safety in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Subagent Safety safe to use?

SkillMD's automated safety review verdict for this skill is PASS. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: makes network calls. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Subagent Safety?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Subagent Safety free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Subagent Safety?

matteobortolazzo (@matteobortolazzo) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Subagent Safety by matteobortolazzo

Name: Subagent Safety
Rating: 4.666666666666667 (3 reviews)
Author: matteobortolazzo

File contents

Delegation Boundary

Worker agents may be unable to surface approval prompts, authentication failures, or user questions to the active conversation. Delegate bounded work that can complete without those interactions.

Generally safe to delegate:

Code reading, file searching, analysis, and review
Focused documentation lookup
Local edits within an explicitly assigned worktree and file scope
Builds and tests whose dependencies and permissions are already available
Read-only external queries after the conversation-owning agent has verified access

Keep with the conversation-owning agent:

Questions or decisions that require the user
Approval or escalation requests
Authentication setup and recovery
Push, fetch, pull, PR creation, ticket changes, comment replies, and other external mutations unless the client explicitly supports delegated authorization
Operations that mutate shared branches, shared worktrees, or global configuration
Any task whose likely failure can only be resolved interactively

Before delegating an authenticated read, verify access in the current session. Give the worker an exact objective, owned paths, allowed side effects, required output, and a stopping condition.

Client Notes

Claude Code

AskUserQuestion is main-agent-only. Claude Code subagents can silently stall on permission or authentication prompts, so keep mutating gh commands and authenticated git operations with the main agent. In the cenci-sandbox container, skip-permissions removes permission prompts but does not remove authentication or user-interaction failures.

Claude Code 1M-context sessions can reject Task delegation when subagents are not pinned to a 200K model. cenci configures CLAUDE_CODE_SUBAGENT_MODEL=claude-sonnet-5 as an optional workaround. Do not infer or announce the active model/context size. If delegation fails with the documented usage-credit error, tell the user to run /cenci:configure and restart, or use a standard-context session.

Codex

Use Codex worker/subagent tools only for concrete, bounded tasks that can run independently. Keep user-input tools and escalation in the root conversation. Do not assume a connector authorized in the root agent can be mutated safely by a worker; prefer read-only connector work unless the delegated tool contract explicitly guarantees authorization and error delivery.

---name: subagent-safetydescription: Decide which work is safe to delegate to worker agents. Use before delegating tasks that may require user interaction, approval, authentication, external writes, or shared-state mutation.---## Delegation BoundaryWorker agents may be unable to surface approval prompts, authentication failures, oruser questions to the active conversation. Delegate bounded work that can completewithout those interactions.**Generally safe to delegate:**- Code reading, file searching, analysis, and review- Focused documentation lookup- Local edits within an explicitly assigned worktree and file scope- Builds and tests whose dependencies and permissions are already available- Read-only external queries after the conversation-owning agent has verified access**Keep with the conversation-owning agent:**- Questions or decisions that require the user- Approval or escalation requests- Authentication setup and recovery- Push, fetch, pull, PR creation, ticket changes, comment replies, and other external mutations unless the client explicitly supports delegated authorization- Operations that mutate shared branches, shared worktrees, or global configuration- Any task whose likely failure can only be resolved interactivelyBefore delegating an authenticated read, verify access in the current session. Givethe worker an exact objective, owned paths, allowed side effects, required output, anda stopping condition.## Client Notes### Claude Code`AskUserQuestion` is main-agent-only. Claude Code subagents can silently stall onpermission or authentication prompts, so keep mutating `gh` commands and authenticatedgit operations with the main agent. In the cenci-sandbox container,skip-permissions removes permission prompts but does not remove authentication oruser-interaction failures.Claude Code 1M-context sessions can reject `Task` delegation when subagents are notpinned to a 200K model. cenci configures`CLAUDE_CODE_SUBAGENT_MODEL=claude-sonnet-5` as an optional workaround. Do not inferor announce the active model/context size. If delegation fails with the documentedusage-credit error, tell the user to run `/cenci:configure` and restart, or use astandard-context session.### CodexUse Codex worker/subagent tools only for concrete, bounded tasks that can runindependently. Keep user-input tools and escalation in the root conversation. Do notassume a connector authorized in the root agent can be mutated safely by a worker;prefer read-only connector work unless the delegated tool contract explicitlyguarantees authorization and error delivery.

Frequently asked questions

Subagent Safety