The State of Claude Code Agents & Commands

An evidence-based audit of 123 public Claude Code artifacts — 87 subagents and 36 slash commands across 10 repositories — graded by Skill Crossroads (rubric v1.2), the signpost for Claude Code artifacts. Every figure below comes from this run and is traceable to the pinned git trees in the methodology. Generated 2026-07-13.

Edition disclosure — deterministic only. No LLM-assisted checks ran in this edition. Every figure is from Skill Crossroads' pure, bit-reproducible deterministic checks. The triggering figures come from the deterministic description-quality checks (TRIGGER-02 description length, TRIGGER-03 invocation cues, TRIGGER-05 invocation-flag consistency) — not the LLM triggering judge (TRIGGER-01), which was excluded for cost and reproducibility.

Scope. A curated sample of community subagent and command collections (up to 15 artifacts each, 250 total). Only subagent and command artifacts are graded — skills, MCP configs, and plugin manifests in the same repos are out of scope for this report. Repos whose layout Skill Crossroads cannot discover (agents at the repo root or in category directories instead of an agents/ or commands/ parent dir) are disclosed in the methodology table rather than silently dropped.

The headline

Across 87 subagents, the average Skill Crossroads score is 89.1/100. The single most common subagent problem in this run is tools least-privilege (SAFETY-02): 85% don't cleanly pass it (74 of 87).

Across 36 slash commands, the average score is 93.9/100. The most common command problem is recommended fields present (STRUCT-02): 81% don't cleanly pass it (29 of 36).

57% of subagents (50 of 87) declare no tools list at all — which means each one silently inherits every tool, including unrestricted Bash. Add 16 more granting bare Bash and 8 granting a wildcard, and 85% of the subagent sample is not least-privilege (SAFETY-02).

Grade distribution

Average overall: subagents 89.1/100, commands 93.9/100. Deterministic grades are computed over the evaluated categories with weights renormalized — LLM-only categories (e.g. Verifiability for agents/commands) stay honestly unscored in this edition.

Read the letter grades honestly. Most published artifacts clear the deterministic floor — structure, budgets, and safety are table stakes, and letter grades cluster high because of it. The discriminating findings live in the LLM-assisted checks (whether a description will actually trigger, whether constraints and failure modes are stated, whether the instructions contradict themselves, whether anything verifies the work) — and none of them ran in this deterministic edition. A high letter grade here means "won't visibly break"; it is a floor, not an endorsement.

How 87 subagents do on each check

Share of the 87 subagents that pass cleanly (higher is better):

STRUCT-01 valid YAML frontmatter              ████████████████░░░░  82%   n=87 (0 warn, 16 fail)
STRUCT-02 recommended fields present          ███████████████░░░░░  76%   n=87 (5 warn, 16 fail)
TOKEN-01 under the line/token budget          ██████████████████░░  91%   n=87 (8 warn, 0 fail)
TOKEN-03 description budget footprint         ████████████████████  98%   n=87 (2 warn, 0 fail)
TOKEN-04 recurring per-invocation cost        ████████████████████  99%   n=87 (1 warn, 0 fail)
CLARITY-03 no ASCII-art / persona filler      ████████████████████  98%   n=87 (1 warn, 1 fail)
SAFETY-01 no hardcoded secrets                ████████████████████ 100%   n=87 (0 warn, 0 fail)
SAFETY-02 tools least-privilege               ███░░░░░░░░░░░░░░░░░  15%   n=87 (66 warn, 8 fail)
SAFETY-03 no destructive auto-invocation      ████████████████░░░░  78%   n=87 (19 warn, 0 fail)
SAFETY-04 no shell-injection in ! blocks      ████████████████████ 100%   n=87 (0 warn, 0 fail)
AGENT-01 declared model is valid              ████████████████████ 100%   n=87 (0 warn, 0 fail)
TRIGGER-02 description long enough to anchor  ██████████████░░░░░░  71%   n=87 (7 warn, 18 fail)
TRIGGER-03 invocation cues in description     ███░░░░░░░░░░░░░░░░░  17%   n=87 (56 warn, 16 fail)
TRIGGER-05 invocation flags consistent        ████████████████████ 100%   n=87 (0 warn, 0 fail)

How 36 slash commands do on each check

Share of the 36 commands that pass cleanly (higher is better):

STRUCT-01 valid YAML frontmatter              ████████████████████ 100%   n=36 (0 warn, 0 fail)
STRUCT-02 recommended fields present          ████░░░░░░░░░░░░░░░░  19%   n=36 (29 warn, 0 fail)
TOKEN-01 under the line/token budget          ███████████████████░  97%   n=36 (1 warn, 0 fail)
TOKEN-03 description budget footprint         ████████████████████ 100%   n=36 (0 warn, 0 fail)
TOKEN-04 recurring per-invocation cost        ████████████████████ 100%   n=36 (0 warn, 0 fail)
CLARITY-03 no ASCII-art / persona filler      █████████████████░░░  83%   n=36 (4 warn, 2 fail)
SAFETY-01 no hardcoded secrets                ████████████████████ 100%   n=36 (0 warn, 0 fail)
SAFETY-02 tools least-privilege               █████████████████░░░  86%   n=36 (5 warn, 0 fail)
SAFETY-03 no destructive auto-invocation      ███████████████████░  94%   n=36 (2 warn, 0 fail)
SAFETY-04 no shell-injection in ! blocks      ████████████████████ 100%   n=36 (0 warn, 0 fail)
CMD-01 arguments and argument-hint agree      ████████████████░░░░  78%   n=36 (8 warn, 0 fail)

Findings

• The no-tools inherits-everything trap (SAFETY-02). 50 of 87 subagents (57%) omit the tools field. That reads like a safe default but is the opposite: a subagent without a tools list inherits the caller's entire toolbox — Bash included — so a delegated worker meant to "just read code" can run arbitrary shell commands. 16 more grant bare Bash outright and 8 grant a wildcard.
• Model declarations are clean (AGENT-01). 0 of 87 subagents have a typo'd model: value — every declared model is a recognized alias (sonnet/opus/haiku/inherit) or claude-* id. The runtime-failure trap this check exists for did not appear in this sample.
• Descriptions too thin to trigger delegation (TRIGGER-02/03). 29% of subagent descriptions (25 of 87) are too short to anchor automatic delegation, and 83% (72 of 87) lack the invocation cues ("use when…", "use PROACTIVELY…") Claude matches on. An agent whose description doesn't say when to use it is an agent that never fires. (Deterministic proxies — the LLM triggering judge did not run in this edition.)
• $ARGUMENTS vs argument-hint drift (CMD-01). 8 of 36 commands (22%) use arguments without declaring argument-hint (or declare a hint they never use) — the user gets no signature hint at the prompt, or a misleading one.
• Hardcoded secrets (SAFETY-01). 0 of 123 artifacts (0%) tripped the secret scan — the one check this sample passes across the board.

What this means

0 of 87 subagents (0%) and 3 of 36 commands (8%) pass every deterministic check cleanly.

The most common defects across the sample:

• subagents — tools least-privilege (SAFETY-02): 74 of 87
• subagents — invocation cues in description (TRIGGER-03): 72 of 87
• subagents — description long enough to anchor (TRIGGER-02): 25 of 87
• subagents — recommended fields present (STRUCT-02): 21 of 87
• subagents — no destructive auto-invocation (SAFETY-03): 19 of 87
• commands — recommended fields present (STRUCT-02): 29 of 36
• commands — arguments and argument-hint agree (CMD-01): 8 of 36
• commands — no ASCII-art / persona filler (CLARITY-03): 6 of 36
• commands — tools least-privilege (SAFETY-02): 5 of 36
• commands — no destructive auto-invocation (SAFETY-03): 2 of 36

Each is catchable before publishing, with npx skillcrossroads ./your-repo — the same engine grades agents, commands, skills, MCP configs, and plugins.

Methodology & reproducibility

Skill Crossroads' deterministic checks only (rubric v1.2, no LLM) were run 2026-07-13 against each repo's git tree at the sha below — the engine's own discovery (findArtifactFiles) and grading (auditAsync) pipeline, identical to what the hosted scanner runs on these kinds. Deterministic checks are pure, so re-scanning the same tree reproduces these figures exactly. The LLM-assisted checks (TRIGGER-01 triggering judge, VERIFY-04, CLARITY-05, CLARITY-02) were excluded from this edition for cost and reproducibility — triggering figures above are the deterministic TRIGGER-02/03/05 proxies.

Caps: up to 15 artifacts per repo (BEACON_MAX_PER_REPO), 250 total (BEACON_MAX_TOTAL). Discovery finds .md files whose parent directory is agents/ or commands/ at any depth; each kind is sampled alphabetically, and when a repo ships both kinds the per-repo cap is split between them so neither crowds the other out of the sample. "Discovered" below is everything in the tree matching that layout; "graded" is the capped sample this report aggregates. A repo where discovery finds nothing is marked "no discoverable agent/command layout".

Reproduce: npm run build && node scripts/state-of-agents.mjs (default repo set; set GITHUB_TOKEN for rate limits) — or pass owner/repo … to scan your own.