Claude-Code-Project-Structure-Learning-Repository: Agent for Claude Code

.claude/agents/ — Sub-Agents

Sub-agents are specialist Claude instances that the main Claude agent can spawn to handle a focused, isolated task.

Think of them like calling in a specialist consultant: the main Claude is a generalist handling your conversation, and it can call a sub-agent that has one narrow job and does it very thoroughly.

---

How Sub-Agents Work

You: "do a security audit before we deploy"
              ↓
Main Claude decides this needs the security-reviewer agent
              ↓
Main Claude spawns security-reviewer as a sub-process
              ↓
security-reviewer reads the codebase with its own focused checklist
              ↓
security-reviewer returns a structured report to main Claude
              ↓
Main Claude presents the findings to you

The sub-agent runs independently — it has its own context, its own instructions, and its own output format. It does not share the main conversation's context.

---

What Goes in an Agent File

An agent file is a Markdown file in .claude/agents/ that defines:

# Agent: <Name>

## Description
What this agent does and what it specialises in.

## When to Use
When should the main Claude spawn this agent?

## Agent Instructions
The detailed, step-by-step checklist the agent follows.

## Output Format
The exact structure the agent must use in its response.

---

The security-reviewer Agent (This Project)

File: .claude/agents/security-reviewer.md

This agent performs a dedicated security audit with five checklists:

Checklist	What it looks for
Auth & Authorization	Routes missing token verification, ownership checks
Input Validation	SQL injection via string interpolation, unsafe file uploads
Sensitive Data Exposure	Passwords in responses, secrets in logs, raw error messages
Configuration	Hardcoded secrets, allow_origins: ["*"], debug mode on
Rate Limiting	Missing rate limits on public endpoints, no pagination cap