Claude Agent Templates: I Audited All 423 in the Biggest Catalog (56% Hand Over Bash)

Search for claude agent templates and you’ll find a catalog with 422 agents in it, a CLI that claims half a million downloads, and almost no advice on which ones to install. So I downloaded the biggest catalog and read the header of every agent file myself: 423 files from the davila7/claude-code-templates repo, the library behind aitmpl.com, at its 2026-10-09 commit. I didn’t care what the agents say they do. I cared what each file actually grants: which tools, which model, and how much text it puts into your context before it ever runs.

The headline: 235 of the 417 agents with a valid header can run shell commands. Anthropic’s own reference set of four complete agents gives Bash to exactly one.

Disclosure before you read further. I sell consulting and done-for-you builds, and I run a fleet of Claude Code agents across 10+ brand containers that write this site, schedule its social posts and log their own failures. I have not run these 423 agents in production, and I won’t pretend I have. What I have run for months is a templated skill library copied from brand to brand, and near the end I’ll show you what that did to my own fleet, with receipts from the run that published this post.

Here’s what you’ll get: what Claude agent templates actually are, the audit numbers, the permission problem, the context bill nobody lists, catalog hygiene, my own template residue, and a five-minute review to run before you install anything.

What Claude Agent Templates Actually Are (One File, Four Lines That Matter)

A Claude agent template is a subagent definition: one Markdown file you drop into .claude/agents/ inside a project, or into ~/.claude/agents/ to make it available everywhere. The file has two parts. A short YAML header at the top, and a body underneath that becomes the agent’s system prompt.

The header is where all the risk and all the cost live. Four fields matter:

• name: how the agent is addressed. Two agents with the same name is a problem (more on that below).
• description: what your main Claude session reads when it decides whether to hand a task to this agent. It is written for the router, not for you.
• tools: the allowlist. Leave the line out and the agent inherits every tool the main session has, including any MCP servers you’ve connected to email, a CRM or a database.
• model: sonnet, opus, haiku, inherit, or a full model ID.

Here’s a complete, minimal, sane agent file:

---
name: link-checker
description: Checks every outbound link in a draft and reports dead ones. Use before publishing.
tools: Read, Grep, WebFetch
model: inherit
---
You check links. You never edit files. Report each dead URL with the line it appears on.

That’s the whole format. Everything a catalog sells you is a variation on those few lines plus a longer body.

One warning about the word “template”: it gets stretched to cover everything. The same repo ships 423 agents, 914 skills, 348 slash commands, 105 MCP configs, 63 hook configs and 73 settings files, which is roughly 1,900 components. Claude4World’s “18 Claude Code templates” are whole project starters. DataCamp’s guide splits templates into six types. This post is about the agent files, because that’s where permissions get granted. If you’re still deciding whether you need subagents at all, start with when Claude Code subagents actually help. If you’re looking at bundles, read my operator guide to Claude Code plugins.

I Audited All 423 Claude Agent Templates in the Biggest Catalog

Method, so you can check me: a shallow clone of github.com/davila7/claude-code-templates at commit ed9fc5d (committed 2026-10-09), then a script that parsed the header of every .md file under cli-tool/components/agents/. That’s 423 files across 28 categories, which matches the “422 components” aitmpl.com shows on its agents page. I read the files as data and ran none of them. Token figures below are characters divided by four, a rough estimate rather than a tokenizer count.

What I checked	Count	Share
Agent files	423	—
Files with a valid header	417	98.6%
Grant Bash (shell access)	235	56%
Grant Write or Edit	290	70%
Grant Bash and Write/Edit	219	53%
Read-only (no Bash, no Write/Edit)	106	25%
No tools line at all (inherits everything)	5	1%
No model line	335	80%
Description longer than 1,000 characters	176	42%
Names used by two different files	13 names / 26 files	—
No header at all	6	1.4%

The median agent file is 7,882 bytes, about 2,000 tokens of system prompt. The biggest, security-engineer, is 33,714 bytes. The smallest, planner, is 840.

Why hasn’t anyone published what Claude agent templates actually grant? Look at who ranks. On 2026-10-10 the top result for “claude agent templates” is the catalog author’s own origin story on Medium (February 2026, “500K+ downloads”, mostly behind the member wall). Number two is Anthropic’s example file. The rest of the top ten is a Notion page, an article about email templates, YouTube videos, a paid storefront listing eight agents (exactly one is actually for sale, at $9.99, “regularly $29”), a roundup of PRD templates and a directory of project starters. Five days earlier aitmpl.com ranked #1 itself. Tonight it isn’t in the top 20. Plenty of pages describe these files. None of them reports what the files grant.

The Permission Problem: Most Claude Agent Templates Hand Over Bash

Bash is the big one. An agent with Bash can do anything your user account can do: run scripts, curl a URL, read your .env, git push, delete a directory. Write and Edit let it change files. Neither is wrong on its own. A builder agent needs both. The question is whether the grant was a decision or a default.

Anthropic’s reference is clear about which one it should be. The complete-agent-examples.md file in the official claude-code repo defines four full agents. Every one sets model: inherit and an explicit tools list. Two are read-only (Read, Grep, Glob). Only one gets Bash.

The community catalog runs the other way. 56% of agents get Bash and 53% get Bash plus write access. Only a quarter are read-only. The most popular agent on aitmpl, frontend-developer, first in its “Most Popular” sort, grants Read, Write, Edit, Bash, Glob, Grep. For an agent that builds frontends, that’s defensible. For a reviewer, an advisor or a researcher, it isn’t, and those make up a big slice of the catalog: expert-advisors is its largest category, with 52 agents.

The clearest illustration isn’t even in the catalog. DataCamp’s guide to Claude Code templates shows a sample security-auditor agent whose description says it produces a findings report “without modifying files.” Its tools line is Read, Glob, Grep, Bash. Bash can modify files. The prompt says “don’t”, and the allowlist says “you can”.

The prompt is a request. The tools line is the enforcement. If an agent must never change anything, take away the tools that change things. Don’t ask it nicely.

Then there are the five agents with no tools line at all. Those inherit everything, including whatever MCP servers you’ve wired up. If your session can send email, so can they.

This is also a supply-chain question. An agent file is a set of instructions, written by a stranger, for a process that holds your credentials. The trust levels I use for plugins (official, community, random marketplace) apply here unchanged, and I’ve laid them out in the plugins guide. The short version: pin to a commit, read the body, and grep it for URLs before it ever runs.

The Context Bill: What Claude Agent Templates Cost Before They Run

Here’s the cost no catalog lists. An agent’s body only loads when the agent is called. Its description is different. Claude Code lists every available agent’s description to the main session so it can decide when to delegate. That means you pay for every installed agent’s description on every session, whether you use the agent or not.

For most Claude agent templates the bill is small. The median description is 223 characters, about 56 tokens. But 176 agents (42%) carry descriptions longer than 1,000 characters, and 180 embed full <example> dialogues, with fake user requests and fake assistant replies, inside the description field. Among those long ones, the average is 2,880 characters, roughly 720 tokens each. frontend-developer‘s description alone runs 3,042 characters.

• All 417 descriptions together: 550,235 characters, about 137,000 tokens.
• The 20 heaviest: 85,977 characters, about 21,500 tokens, before any work starts.

Nobody installs all 417. But “install the pack for my stack” is exactly how these CLIs are meant to be used, and twenty agents is an ordinary afternoon. I measured the same effect on the other always-loaded file, and the numbers are in my CLAUDE.md teardown: about 7,400 tokens a run, and 47.8% of it was dead weight for the job at hand. And if you want the general fix, I wrote up three ways to bound what an agent reads at startup.

The cost isn’t only tokens. Every description competes with every other description for the router’s attention. Twenty agents with overlapping, example-stuffed descriptions give your main session more ways to pick the wrong one. That’s my reasoning, not something I measured on this catalog, but it’s the reason I keep descriptions to one or two sentences of trigger conditions and move every example into the body, where it costs nothing until it’s needed.

Catalog Hygiene: Duplicate Names, Missing Headers, and Model Pins That Won’t Resolve

The rest of the audit is smaller stuff, but it’s the kind of thing that bites quietly when you install Claude agent templates in bulk.

Thirteen names, twenty-six files

prompt-engineer, context-manager, security-engineer, test-automator, performance-engineer, incident-responder and seven more each exist twice, in different categories, with different contents. Install both and you have two files fighting over one name, and you can’t tell from the name which one you’re getting. Remember context-manager. It comes back in a minute.

Six files with no header

Without the YAML header, Claude Code has nothing to register. The file is just Markdown sitting in a folder. One of the six is committed twice, at paths that repeat their own folder (business-marketing/cli-tool/components/agents/business-marketing/...), the fingerprint of a copy command run from the wrong directory.

Model lines that age badly

335 agents leave model unset, which is fine and arguably the best choice. Four say model: Claude, which isn’t one of the documented values. Six pin specific older Sonnet versions (claude-sonnet-4, claude-sonnet-4-5, claude-sonnet-4-5-20250929). Pinned model IDs are a maintenance debt with a retirement date attached. My own stack pins six models, and I wrote about what happens when one gets retired.

To be fair: this catalog is free, actively maintained (last commit the day before I cloned it), and 422 agents is an enormous amount of volunteer work. None of the above is a scandal. The problem isn’t the catalog. The problem is installing from it without reading.

What Templating Did to My Own Fleet (the Receipts No Catalog Shows)

Here’s the part I can speak to first-hand. JonOps, the system that runs my brands, is itself a template: one library of skill files, copied into every brand’s container, then bent to fit that brand. This container holds 39 skill files totalling 472,860 bytes, plus 22 .bak copies left behind by in-place fixes.

Tonight’s receipt comes from the run that published this post. The blog-writer skill driving it still says, in its publishing step, to “default to category 171 (The world of Horoscope)”. On jonjones.ai, category 171 returns a 404. Its Asana step points at project 1213328321428246, which resolves to WeLoveHoroscope, a different brand in the fleet. It tells the writer to plan internal links to “existing WLH posts” and to italicise “astrological terms on first use”. In total, 10 of the 39 skill files in this container still mention the horoscope brand they were templated from.

That residue is mostly harmless, because it’s loud. It looks wrong, and the brand’s own config file overrides it. The dangerous residue is the quiet kind. Three examples from this same fleet:

1. A field name with the wrong capitalisation. The template wrote Status. This brand’s keyword table calls the field status. Airtable is case-insensitive when you read with a formula and case-sensitive when you write. So every read worked and every status write failed. That ran for months. The first keyword this skill ever successfully closed was on 2026-10-08.
2. A field that doesn’t exist. The image script logs each image to a field called Name, which this brand’s images table doesn’t have. Airtable rejects the record and the script exits 0. Tonight’s seven images came back with an empty record ID too.
3. A hand-off that has never fired. The content-refresh step reads its instructions from a field called Refresh Brief. This brand’s table calls it Suggested Action. So even a queued refresh would arrive with an empty brief, and the hand-off between the two skills has never fired on this brand.

Notice that none of these crashed. When a template’s assumption doesn’t hold, it rarely errors. It does nothing, or something slightly wrong, and reports success.

Community Claude agent templates carry the same kind of assumptions, just about your repo instead of your database. frontend-developer‘s own example dialogue opens with “First, let me query the context-manager for your existing infrastructure.” That’s an agent you may not have installed, and in this catalog it’s one of the names that exists twice. An agent that leans on a missing teammate won’t throw an error. It’ll improvise.

The Five-Minute Review Before You Install Any Claude Agent Template

This is the check I’d run on any of the Claude agent templates in this post, whether it’s from a catalog, a paid storefront or a colleague’s repo. It takes five minutes, and it catches everything in the audit above.

1. Read the tools line first. No line means everything. For a reviewer, researcher or advisor, strip Bash and Write. Start from Anthropic’s read-only baseline (Read, Grep, Glob) and add only what the job proves it needs.
2. Measure the description. If it’s longer than a couple of sentences, or has <example> blocks, move the examples into the body. You pay for the description every session.
3. Fix the model line. Delete invalid values and dated pins. Use inherit unless you have a reason not to.
4. Grep the body. Look for network calls, secrets and references to other agents.
5. Check for name collisions against what’s already in your project and user agent folders.
6. Own the copy. Commit the file into your repo at a known version and review future changes as a diff. Don’t re-pull updates blind.

# 1-2: tools line and description size
grep -E '^(tools|model):' .claude/agents/new-agent.md
sed -n '/^description:/,/^[a-z]*:/p' .claude/agents/new-agent.md | wc -c

# 4: anything that leaves the machine or touches secrets
grep -nEi 'curl|wget|https?://|\.env|token|secret|git push' .claude/agents/new-agent.md

# 4: does it depend on agents you don't have?
grep -noE '[a-z]+-(manager|engineer|reviewer|agent)' .claude/agents/new-agent.md | sort -u

# 5: name collisions
grep -h '^name:' .claude/agents/*.md ~/.claude/agents/*.md 2>/dev/null | sort | uniq -d

Then install three, not thirty. The agents worth keeping are the ones you’d have written yourself if you’d had the time, trimmed to your stack. It’s the same pick, adapt and harden discipline I use for n8n templates in production, and the same “steal the structure, not the hype” verdict I reached on the Everything Claude Code repo.

If you’d rather have someone who has already broken this in production set it up for your business, scoped, permissioned and with a hand-off you own, that’s what my done-for-you builds are. Book an automation strategy session and bring the agent list you were about to install.

Claude Agent Templates: Frequently Asked Questions

Are Claude agent templates safe to install?

Claude agent templates are as safe as their tools line. A read-only agent can leak what it reads but can’t change anything. An agent with Bash can do anything your account can. In the largest catalog, 56% grant Bash. Read the header and grep the body before installing, and pin the file to a known commit.

Where do Claude agent templates go?

Project agents go in .claude/agents/ in the repo, so they travel with the project and get reviewed in git. Personal agents go in ~/.claude/agents/ and apply to every project on the machine. Keep anything with write access at the project level, where it gets reviewed.

What’s the difference between an agent template and a skill?

An agent is a separate worker with its own context window, tool allowlist and model. A skill is a set of instructions (plus optional files) that the current session loads when a task matches. Use an agent when you want isolation and a tighter permission set. Use a skill when you want the main session to follow a procedure. The CLAUDE.md post covers where CLAUDE.md, skills and hooks each belong.

Do installed agents cost tokens when I don’t use them?

Their descriptions do, because they’re listed to the main session so it can decide when to delegate. Their bodies don’t, until they’re called. That’s why a 3,000-character description is a real cost and a 3,000-word body mostly isn’t.

Are paid Claude agent templates better than free ones?

Price tells you nothing about the tools line. The paid storefront ranking for this term lists eight agents, and seven of them are “coming soon.” Run the same five-minute review on a $9.99 agent that you’d run on a free one.

How many agent templates should I install?

As few Claude agent templates as the work needs. Every one adds to the description bill and to the router’s choices. Start with the two or three jobs you repeat weekly, and add an agent only when you catch yourself writing the same instructions again.

Final Thoughts: Treat Every Claude Agent Template as a Fork

The catalogs of Claude agent templates aren’t the problem. 1,900 free components is a gift, and some of those agents are better starting points than anything you’d write from a blank file. The problem is the install-it-and-forget-it model. A template is someone else’s assumptions about your repo, your tools and your threat model, frozen at the moment they wrote it.

So treat each one as a fork. Read the four header lines. Shrink the tools to the job. Cut the description to its trigger. Commit the result and own it. My own fleet carried another brand’s category ID for months because nobody re-read the template after copying it. The first step of using any template is reading it.

If you want the build logs behind posts like this, including what broke, what it cost and what I changed, they go out in the newsletter below.