Claude Code 精通指南 第6篇：子代理

你："审查这个 PR 的安全问题，检查测试覆盖率，并更新 API 文档"

Claude 内部处理：
├─→ Task(安全审计员) → 安全发现
├─→ Task(覆盖率分析器) → 覆盖率报告
└─→ Task(文档撰写者) → 更新后的文档

Claude："以下是我在三个方面的发现..."

"使用 Explore 代理查找所有处理用户认证的文件"

"使用 Plan 代理设计我们应该如何实现实时通知功能"

"使用 Bash 代理运行测试套件并总结失败项"

"使用通用代理研究速率限制的最佳实践"

.claude/agents/
└── security-auditor/
    └── AGENT.md

---
Name: security-auditor
Description: "Audit code for security vulnerabilities including OWASP Top 10, authentication issues, data exposure, and injection attacks"
Tools: Read, Grep, Glob
Model: sonnet
---

# Security Auditor

You are a security specialist focused on finding vulnerabilities in code.

## Process

1. Scan for hardcoded secrets (API keys, passwords, tokens)
2. Check input validation on all user-facing endpoints
3. Review authentication and authorization flows
4. Analyze data handling for exposure risks
5. Look for injection vulnerabilities (SQL, command, XSS)
6. Check error messages for information leakage

## Output Format

Organize findings by severity:

### Critical (Must Fix Before Merge)
- Issue description
- File and line number
- Why it's dangerous
- How to fix it

### Warning (Should Fix)
- Same format as critical

### Info (Consider Fixing)
- Same format

## Constraints

- Read-only: analyze and report, don't modify code
- Flag uncertainty: if unsure, mark for human review
- Be specific: vague warnings aren't actionable

"使用 security-auditor 代理审查这个 PR 的改动"

"对 src/auth/ 运行 security-auditor"

"让安全审计员检查新的支付端点"

"使用 security-auditor、performance-analyzer
和 test-coverage 代理并行审查这个 PR"

┌─→ 安全代理 ──→ 安全报告
              │
你的代码 ────┼─→ 性能代理 ─→ 性能报告
              │
              └─→ 覆盖率代理 ───→ 覆盖率报告

                        ↓
                    综合分析

代码 → 分析代理 → 分析结果
                      ↓
          重构代理 → 改进后的代码
                          ↓
                    测试代理 → 测试

"实现用户仪表板功能"

Claude 内部路由：
├─→ 前端代理 (React 组件)
├─→ 后端代理 (API 端点)
└─→ 数据库代理 (Schema 变更)

mkdir -p .claude/agents/security-auditor
cat > .claude/agents/security-auditor/AGENT.md << 'EOF'
---
Name: security-auditor
Description: "Review code for security vulnerabilities, OWASP issues, auth problems"
Tools: Read, Grep, Glob
Model: sonnet
---

# Security Auditor

Focus: Finding security vulnerabilities.

## Checklist
- [ ] Hardcoded secrets
- [ ] SQL/command injection
- [ ] XSS vulnerabilities
- [ ] Auth/authz issues
- [ ] Data exposure
- [ ] Insecure dependencies

## Output
Rate each finding: Critical / Warning / Info
Include: file, line, issue, fix
EOF

mkdir -p .claude/agents/performance-analyzer
cat > .claude/agents/performance-analyzer/AGENT.md << 'EOF'
---
Name: performance-analyzer
Description: "Analyze code for performance issues, N+1 queries, memory leaks, bottlenecks"
Tools: Read, Grep, Glob
Model: sonnet
---

# Performance Analyzer

Focus: Finding performance problems.

## Checklist
- [ ] N+1 database queries
- [ ] Missing indexes
- [ ] Unnecessary re-renders
- [ ] Memory leaks
- [ ] Blocking operations
- [ ] Large payload transfers

## Output
Rate each finding: Critical / Warning / Info
Include: file, line, issue, estimated impact, fix
EOF

mkdir -p .claude/agents/test-coverage
cat > .claude/agents/test-coverage/AGENT.md << 'EOF'
---
Name: test-coverage
Description: "Analyze test coverage, identify untested code paths, suggest missing tests"
Tools: Read, Grep, Glob, Bash
Model: sonnet
---

# Test Coverage Analyzer

Focus: Identifying gaps in test coverage.

## Process
1. Run existing tests to check current coverage
2. Identify untested functions and branches
3. Flag critical paths without tests
4. Suggest specific test cases to add

## Output
- Current coverage percentage
- List of untested critical paths
- Suggested test cases with priority
EOF

"使用 security-auditor、performance-analyzer 和 test-coverage
代理并行对 auth 模块执行全面审查"

# 不好 - 太模糊
Description: "Helps with code"

# 好 - 具体触发条件
Description: "Review code for SQL injection, XSS, CSRF, and authentication vulnerabilities using OWASP guidelines"

# 分析类代理：只读
Tools: Read, Grep, Glob

# 编写类代理：可以修改
Tools: Read, Write, Edit

# 运行类代理：可以执行
Tools: Read, Bash

git clone https://github.com/VoltAgent/awesome-claude-code-subagents.git .claude/agents/voltagent