subinium-agentic-workflow-config

A battle-tested ~/.claude/ configuration that turns Claude Code into a parallel agentic development environment — instructions, skills, agents, hooks, and rules deployable with one command.

한국어 README · scores 99/100 (S) on AgentLinter

💚 Want host-portable skills (Codex CLI, Cursor, Copilot, Cline)? Pair this harness with /vibesubin — same author, complementary scope. This repo configures the agent. vibesubin ships the playbook.

Install

git clone https://github.com/subinium/subinium-agentic-workflow-config.git
cd subinium-agentic-workflow-config
bash install.sh    # Deploys to ~/.claude/, backs up existing config

Then restart Claude Code. That's it.

# Validate after install
npx agentlinter@latest ~/.claude

Why This Exists

Out of the box, Claude Code has no opinion. It asks permission for every git push, formats nothing, has no security guardrails, and treats every task as a single-threaded conversation.

This config adds three layers:

1. Parallelism-first workflow — CLAUDE.md instructs the agent to decompose tasks and run independent work simultaneously. Multiple file reads, parallel agent spawns, lint+typecheck+test all at once.
2. Defense-in-depth security — Three independent layers (settings deny rules, runtime command + file-path hooks, behavioral rules in CLAUDE.md) prevent reading .env, force-pushing, or leaking secrets.
3. Structured skills — Slash commands like /security-audit, /ship, or /release trigger complete, reproducible workflows instead of relying on vague prompts.

Companion: /vibesubin

This repo configures the agent itself. vibesubin is a portable skill plugin that captures the habits — refactor-verify, audit-security, setup-ci, fight-repo-rot, ship-cycle, etc. — so a single /vibesubin sweep runs every code-hygiene specialist in parallel and returns a prioritized, evidence-backed report. Same SKILL.md files work in Claude Code, Codex CLI, Cursor, Copilot, and any skills.sh-compatible host.

The split: this repo = the harness (CLAUDE.md, hooks, agents, rules, permissions). vibesubin = the playbook (host-portable skills you call by name or sweep all at once). See docs/vibesubin-merge-candidates.md for which patterns from this repo are scheduled to land in vibesubin.

What Gets Deployed

CLAUDE.md — The Brain

The global instruction file shaping every Claude Code response.

settings.json — Permissions & Hooks

{
  "env": { "CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS": "1" },
  "permissions": {
    "allow": [ /* safe commands auto-approved */ ],
    "deny":  [ /* secret-access patterns blocked */ ]
  },
  "hooks": { /* lifecycle event hooks */ }
}

Allow list covers safe, read-heavy commands (git status/log/diff, npm run lint/test, ls, gh api, tsc, prettier, cargo) so Claude doesn't break focus asking permission for routine actions. Destructive commands are caught by the runtime hook.

Deny list blocks reads/writes on .env, .envrc, .ssh/**, .aws/**, .kube/config, .npmrc, .netrc, *.pem, *.key, *credentials*, *.sqlite before Claude can attempt them. The guard-sensitive-files.sh hook adds a runtime second line of defense.

Skills — Slash Commands

20 skills shipped, organized by purpose.

Always-on guidance (auto-activating)

Core workflow

Session lifecycle

Research & analysis

Maintenance & release

Communication & launch

Meta

Agents — Specialized Workers

Markdown files in ~/.claude/agents/ with model/tool frontmatter. Default: Opus, with model: sonnet or model: haiku overrides where speed/cost matters.

Rules — Auto-Loaded Guidelines

Files in ~/.claude/rules/ load alongside CLAUDE.md.

Hooks — Lifecycle Scripts

Bash scripts triggered by Claude Code lifecycle events.

Security Architecture

Three independent layers — if one fails, the others still protect you.

Request → settings.json deny → guard-sensitive-files.sh / block-destructive-git.sh → CLAUDE.md rules → Execution

Agent Teams

Enabled via CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=1. Research preview — multiple Claude instances collaborate through shared task lists and messaging.

Customizing

Edit files in this repo, then bash install.sh to redeploy. Existing top-level config is auto-backed up (latest 3 kept).

• Add a skill: drop a directory under home-claude/skills/{name}/ containing SKILL.md. install.sh picks it up automatically — no code change needed.
• Add an agent: drop a .md file under home-claude/agents/.
• Add a hook: drop a .sh file under hooks/, then register it in the hooks section of home-claude/settings.json.
• Change permissions: edit home-claude/settings.json — allow for auto-approve, deny for hard block.

License

MIT

Author

subinium (Subin An)