run-tasks — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited run-tasks (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill orchestrates autonomous task execution using Claude Code's native Agent Team system. It takes tasks produced by /create-tasks, builds a dependency-aware execution plan, and executes them in waves via a 3-tier agent hierarchy: Orchestrator (this skill) plans and coordinates waves, Wave Leads manage parallel executors within each wave, and Context Managers handle knowledge flow between tasks.
The wave-lead creates its own team and coordinates teammates via SendMessage. The orchestrator communicates with the wave-lead via file-based summaries (wave-{N}-summary.md).
Before executing any step, load the foundational references for task management and team orchestration:
Read ${CLAUDE_PLUGIN_ROOT}/../claude-tools/skills/claude-code-tasks/SKILL.mdRead ${CLAUDE_PLUGIN_ROOT}/../claude-tools/skills/claude-code-teams/SKILL.mdThese references provide tool parameters, lifecycle rules, messaging protocols, and orchestration patterns. The SDD-specific execution procedures are in the orchestration reference below.
Read ${CLAUDE_PLUGIN_ROOT}/../claude-tools/skills/claude-code-teams/references/orchestration-patterns.mdRead ${CLAUDE_PLUGIN_ROOT}/skills/run-tasks/references/orchestration.mdIf any reference file cannot be read, stop and report: "ERROR: Cannot load required reference. Verify the plugin installation is complete."
Parse the following arguments from the user's invocation:
| Argument | Format | Default | Description |
|---|---|---|---|
<task-id> | positional integer | _(none — all tasks)_ | Execute a single specific task by ID. Mutually exclusive with --task-group and --phase. |
--task-group | <name> | _(none — all tasks)_ | Filter tasks to those with matching metadata.task_group |
--phase | <N> or <N,M,...> | _(none — all phases)_ | Comma-separated integers. Filter tasks by metadata.spec_phase. Tasks without spec_phase are excluded when active. |
--max-parallel | <N> | _(from settings)_ | Override run-tasks.max_parallel setting for this run. Must be a positive integer. |
--retries | <N> | _(from settings)_ | Override run-tasks.max_retries setting for this run. Must be a non-negative integer (0 = no retries). |
--dry-run | _(flag)_ | false | Complete Steps 1-3 only: load, plan, display. No agents spawned, no session directory created. |
When both --task-group and --phase are provided, both filters apply (intersection). CLI args --max-parallel and --retries take precedence over settings file values.
Validation:
--phase values must be positive integers. If a non-integer value is provided (e.g., --phase abc), report: "Invalid --phase value: must be comma-separated positive integers (e.g., --phase 1,2)." and stop.--max-parallel must be a positive integer. If invalid, report: "Invalid --max-parallel value: must be a positive integer." and stop.--retries must be a non-negative integer. If invalid, report: "Invalid --retries value: must be a non-negative integer." and stop.<task-id> is provided alongside --task-group or --phase, report: "Cannot combine task ID with --task-group or --phase filters." and stop.--phase: "No tasks found for phase(s) {N}. Available phases: {sorted distinct spec_phase values}." For --task-group: "No tasks found for group '{name}'. Available groups: {sorted distinct task_group values}."Load the full task list via TaskList. Apply --task-group and --phase filters if provided. Validate the resulting task set:
/create-tasks first.See references/orchestration.md Step 1 for the full procedure.
Read settings from .claude/agent-alchemy.local.md (use defaults if the file is missing). Build the execution plan:
max_parallel tasks (default: 5, configurable via settings).See references/orchestration.md Step 2 for settings and the full planning procedure.
Present the execution plan to the user via AskUserQuestion:
context_manager_threshold: 1 wave-lead + 1 context-manager + N executors. For smaller waves: 1 wave-lead + N executors (no CM).If `--dry-run`: Display the full plan details (wave breakdown, task assignments, model tiers, timeout estimates) and exit. No TaskUpdate calls, no session directory created, no agents spawned.
If the user cancels: Clean exit with no tasks modified.
See references/orchestration.md Step 3 for display format details.
Create the session directory and handle interrupted session recovery:
{task-group}-{YYYYMMDD}-{HHMMSS} (or exec-session-{YYYYMMDD}-{HHMMSS} if no group).AskUserQuestion: resume (reset in_progress tasks to pending) or fresh start (archive to .claude/sessions/interrupted-{timestamp}/)..claude/sessions/__live_session__/:execution_context.md — empty templatetask_log.md — header row onlyexecution_plan.md — populated from Step 2progress.jsonl — session_start eventSee references/orchestration.md Step 4 for the full initialization procedure and session ID generation rules.
For each wave in the execution plan:
TaskList (dynamic unblocking after prior wave completions).Task (no team_name — the wave-lead creates its own team internally).{session_dir}/wave-{N}-summary.md after the foreground Task completes.task_log.md, write wave_complete event to progress.jsonl, handle Tier 3 escalations (present failures to user via AskUserQuestion with options: Fix manually, Skip, Provide guidance, Abort).TaskStop. Includes inter-wave verification and cooldown before starting the next wave.See references/orchestration.md Step 5 for the full wave execution procedure, retry escalation flow, and wave-lead crash recovery.
Generate a session summary and archive the session:
session_summary.md with pass/partial/fail/skipped counts, total execution time, per-wave breakdown, failed task list with reasons, and key decisions made during execution. PARTIAL tasks (core functionality works, non-critical criteria have issues) are tracked separately from PASS and FAIL — they are counted as completed but distinguished in metrics.session_complete event to progress.jsonl.__live_session__/ contents to .claude/sessions/{session-id}/.See references/orchestration.md Step 6 for the summary format and archival procedure.
Review execution_context.md for project-wide changes and update CLAUDE.md if warranted:
Skip updates if only task-specific or internal implementation details were recorded.
See references/orchestration.md Step 7 for the CLAUDE.md update criteria.
claude-code-teams/references/orchestration-patterns.md) with a 3-tier agent hierarchy that adds Context Managers for cross-task knowledge flow and structured retry intelligence.TeamCreate) and becomes the team lead. It spawns context managers and executors as teammates using SendMessage for coordination. The orchestrator spawns the wave-lead as a plain foreground subagent and reads results from a summary file.Task tool with team_name parameter. This ensures they appear in the team's config.json, enabling defense-in-depth cleanup and proper SendMessage routing. The orchestrator does NOT use team_name when spawning the wave-lead — the wave-lead is the team creator, not a member.TeamDelete, and reports cleanup results in the wave summary file. (2) The orchestrator verifies cleanup by checking if the team directory still exists and force-stops any survivors via TaskStop. The orchestrator cannot call TeamDelete (not the team lead), so orphaned team directories are cleaned up during session initialization.metadata.timeout_minutes.--dry-run completes Steps 1-3 only. Displays the full execution plan without spawning agents or creating a session..claude/sessions/__live_session__/.abort from another terminal. The current wave completes, remaining tasks are marked failed, and the session is archived. Optionally include an abort reason as file content (e.g., echo "requirements changed" > .claude/sessions/__live_session__/.abort).--phase and --task-group can be combined (AND logic). Filters narrow the task set before planning.This skill uses Claude Code hooks for automated quality gates during execution:
verify-task-completion.sh hook runs the project's test suite. If tests fail, the completion is blocked and the task reverts to in_progress with feedback to the executor.Hook definitions are in ${CLAUDE_PLUGIN_ROOT}/hooks/hooks.json. For hook event documentation, see claude-code-teams/references/hooks-integration.md.
/run-tasks/run-tasks --task-group user-authentication/run-tasks --phase 1/run-tasks --task-group payments --phase 1,2/run-tasks --dry-run/run-tasks 5/run-tasks --max-parallel 2/run-tasks --retries 0touch .claude/sessions/__live_session__/.abort
# Or with a reason:
echo "requirements changed" > .claude/sessions/__live_session__/.abort/run-tasks --task-group payments --phase 2 --dry-runreferences/orchestration.md — Detailed 7-step orchestration procedures, wave execution, retry escalation, session management, and CLAUDE.md update criteriareferences/communication-protocols.md — SDD-specific message schemas for the 3-tier hierarchy (6 protocols)references/verification-patterns.md — Verification logic for spec-generated vs general tasks${CLAUDE_PLUGIN_ROOT}/../claude-tools/skills/claude-code-tasks/SKILL.md — Task tool parameters and conventions (loaded at init)${CLAUDE_PLUGIN_ROOT}/../claude-tools/skills/claude-code-teams/SKILL.md — Team lifecycle, messaging, and orchestration patterns (loaded at init)${CLAUDE_PLUGIN_ROOT}/../claude-tools/skills/claude-code-teams/references/orchestration-patterns.md — 6 orchestration patterns (loaded at init, for context)${CLAUDE_PLUGIN_ROOT}/../claude-tools/skills/claude-code-teams/references/messaging-protocol.md — SendMessage types, delivery mechanics, shutdown handshake (loaded by agents)${CLAUDE_PLUGIN_ROOT}/../claude-tools/skills/claude-code-teams/references/hooks-integration.md — TeammateIdle/TaskCompleted hook events~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.