IndexCorp

Agent Team Setup — Security skill for Claude Code

Security community

Skill that turns a repo into a workplace for a team of AI coding agents: organizer interview generates AGENTS.md, HANDOFF.md, inter-agent mailboxes, zone-ownership gates, security review, docs-vs-code.

How to install Agent Team Setup

This entry records only its repository, not the path inside it, so there is no exact command to give. Open IndexCorp/agent-team-setup and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Agent Team Setup does

Skill that turns a repo into a workplace for a team of AI coding agents: organizer interview generates AGENTS.md, HANDOFF.md, inter-agent mailboxes, zone-ownership gates, security review, docs-vs-code sync gate. EN/RU.

Alternatives in Security

  • Security Ownership Map — Map people-to-file ownership, compute bus factor, and identify risks 14.6k ★
  • Deepsec — Deepsec is a security harness for finding vulnerabilities in your codebase powered by coding agents 7.8k ★
  • AWS MCP Server — by alexei-led - Features multiple Python environment setup options with detailed code style guidelines, compre 182 ★

README

agent-team-setup

[🇷🇺 README на русском](README.ru.md)

A skill that turns a repository into a **workplace for a team of AI coding agents** — in one interview.

An organizer agent asks the owner a few questions (which roles, which stack per zone — always offering options), then generates the complete protocol layer: agent rules, entry points, inter-agent mailboxes, zone ownership gates, quality gates, and per-zone READMEs. Works for any composition: backend + frontend, backend + mobile, full team, custom.

**Status: validated on one production project so far** (a multi-agent board classifieds product, 4 agents, several weeks of parallel work). The protocol borrows proven mechanics from obra/superpowers, Claude Code agent teams, BMAD and CODEOWNERS — but it is young. Issues and battle reports are very welcome.

The problem it solves

If you have ever run more than one AI agent on the same repository for longer than a demo, you know the failures:

  • Agents step on each other. Two agents edit the same files; one overwrites the other's work; nobody notices until something breaks. The common advice "just use git worktrees" assumes you can isolate environments — but what if you have one shared dev environment with fixed ports, one database, shared test services?
  • Nobody tells anybody anything. The backend agent adds an endpoint; the frontend agent finds out three days later, from a 500 error. The mobile agent spots a bug in the API and silently works around it — the bug gets re-discovered (and re-worked around) by everyone, forever.
  • Agents write to their own inbox. Coordination files exist, but an agent, in a hurry, writes a task to itself; the addressee never reads it. Work silently stalls.
  • Contracts rot. The API changed, the docs didn't. The next agent trusts the docs and builds against a ghost. Nothing enforces the sync — instructions say "update docs", agents forget.
  • Everything is hardcoded. Domains, ports, secrets, user-facing