57% of public Claude Code subagents inherit Bash

Most public Claude Code subagents give their worker the caller’s full toolbox, Bash included, because they leave out one frontmatter line. The count comes from Skillcrossroads, a linter for skills, subagents, slash commands, .mcp.json configs and plugins. Its author ran it over public repos and published the results on September 17.

Of the 87 subagents scanned, 50 declare no tools list. “That reads like a safe default, but it’s the opposite,” the author writes. With no list, the subagent inherits everything the caller has. Permission prompts still gate execution, but a worker you meant to “just read code” now carries the grant surface to run shell. Another 16 grant bare Bash and 8 grant a wildcard. That makes 74 of the 87 subagents, or 85%, that fail the least-privilege check.

Skills tend to fail in a different place. Of 215 skills scored for triggering, 69% have a description that won’t reliably trigger: 40% are outright unlikely to fire and 28% are borderline. The author calls “my skill never fires” the top real-world failure. Anthropic’s Claude Code docs explain why the description carries so much weight. Claude uses a skill when it judges it relevant, and the skill’s body loads only once it is used, so until then the model decides from the frontmatter alone. Subagents have the same gap: 72 of 87 (83%) have no invocation cue like “use when…” in their description.

Only 1 of 216 skills and 0 of 87 subagents passed every check. Secrets were the one area most files got right: 6 of 216 skills tripped the scanner. Subagents also stood out in August, when a census of 445,348 artefacts found they failed a structural load check at 21.9%, against 9.70% across the whole set.

Most of the checks are deterministic and point to a file and line, for example “SKILL.md:14 links ./references/converter.md, not found”. An optional LLM check, run with your own API key, judges whether a description will trigger. A GitHub Action can block PRs that fail the checks. The project is open-core: the CLI and public audits are free, and the paid product is a hosted Pro tier.

The two scans ran different editions of rubric v1.2. Skills were scored with the LLM checks and agents with deterministic checks only. The skill sample covers 216 skills across 18 repos, and the agent sample covers 87 subagents and 36 commands across 10 repos. Sample caps are disclosed, tree SHAs are pinned and the reproduction commands are published. To run the same checks on your own skill, use npx skillcrossroads ./my-skill.