PRODUCTION SCENARIO
You want a security reviewer that any engineer on the team can hand a diff to. It has to read code without ever writing, run on a cheaper model than the main session to hold review costs down, and keep its long findings out of the conversation the engineer is working in.
How should the reviewer be defined?
Answering here is anonymous. Nothing is saved unless you sign in.
Show answer and explanation
Answer: As a project subagent checked into .claude/agents/, with tools Read, Grep and Glob and a model field
A project subagent lives in .claude/agents/ and is checked into the repository, so the whole team shares one reviewer. Its tools field restricts it to reading, its model field selects the cheaper model, and it runs in its own context window, so findings never crowd the main session. A user-level copy has to be maintained on every machine, and a CLAUDE.md section or a plain skill runs inside the main conversation.
Official Source: https://code.claude.com/docs/en/sub-agents ↗