amElnagdy/delegate-skills

Selection

Select when

• You use Claude Code as an orchestrator and want a separate CLI to implement a bounded task.
• You want one review workflow that can swap among many coding-agent CLIs.
• You need the implementer's diff rather than an API response as the deliverable.
• You want reviewer-controlled commits and independently rerun project gates.
• You want named lanes that bind feature, test, or UI work to different installed CLIs.
• You need structured result files and available session identifiers for automation.
• You want sequential delegated tasks with review between items.
• You need Aider delegation without its default automatic commits.
• You accept each upstream CLI's documented permission and sandbox constraints.
• You can install and authenticate the chosen implementer separately.

Boundaries

Avoid when

• The task is small enough that delegation overhead outweighs the benefit.
• You need one fully uniform hard sandbox across all supported implementers.
• You require guaranteed read-only behavior from a CLI that lacks or weakly enforces it.
• You cannot review the diff and rerun gates after completion.
• You need complete auditing of ignored files, reverted edits, or writes outside the repository.
• You do not want external coding-agent CLIs or their providers to receive project context.
• You cannot install Node 18+, Git, and the selected authenticated implementer CLI.
• You need production-proven support on every operating system and relay.
• You want the implementer to own commits rather than return uncommitted changes.
• You need in-process Claude Code subagents rather than separate CLI sessions.

Strengths

Capabilities

Risk profile

Risks and limitations

• Uncertainty: only selected first-party files were supplied, so relay implementations, setup scripts, schemas, tests, CI workflows, manifests, and most skill files were not directly inspected.
• Uncertainty: repository creation, update, push, and several verification dates extend into 2026 relative to this analysis context, so recency, release state, and adoption metadata cannot be independently reconciled.
• Uncertainty: repository-reported smoke and live-run results were not independently reproduced.
• The full workflow is stated as designed for and run on Claude Code, while other orchestrators are designed-for but generally unproven.
• Several relays are only contract-tested, including OpenCode and Vibe, while Oh My Pi is described as awaiting a live run.
• Native Windows or Linux coverage remains incomplete for multiple implementers, and upstream Vibe officially targets UNIX.
• Security boundaries vary substantially: some implementers have sandboxes, some have advisory read-only modes, and some run with unrestricted user permissions.
• Git status and touchedFiles cannot reveal ignored files, perfectly reverted edits, writes outside the repository, or reliably attribute concurrent changes.
• Every useful dispatch depends on a separately installed and authenticated upstream CLI, account, model endpoint, or provider entitlement.
• Some modes intentionally enable broad permissions such as yolo, auto-approve, full access, or unsandboxed local tools.
• Briefs and project files may be transmitted to upstream providers, and Warp may upload a workspace snapshot unless its no-snapshot option is selected.
• No independent security audit, privacy assessment, comprehensive host compatibility matrix, or cross-agent quality benchmark was supplied.

Repository documentation says relays use Node built-ins only, make no network calls of their own, read or write no credentials, send no telemetry, and never commit. They still launch powerful external agents and Git with the user's permissions. Safety varies by implementer: some offer workspace sandboxes or plan modes, while Kimi, Warp, Pi, Oh My Pi, Aider, Command Code, and other documented paths can have broad or unsandboxed access. touchedFiles is only post-run Git-visible state, not a complete activity log. Broad bypass, yolo, full-access, auto-approve, project-trust, extensions, skills, and MCP options require explicit scrutiny. These are first-party claims and were not independently audited.