The expert teammates Claude Code doesn’t ship with.

Twelve ready-made specialists, from security engineer to seed investor. Type @, pick one, and it takes the job.

claude plugin install truecast --marketplace wastedcode/truecast

Then in Claude Code: /truecast:install security-engineer

Claude Code 2.1.292 or later · free, MIT

security-engineer, reviewing our own installer

… Can anything here get a user owned? …

its playbook · 21 files · it opened 2 skills

grade-and-remediate-riskwrite-the-security-verdict

Verdict: yes, someone can get owned, but only through --project. That path is NO-GO until F1 is fixed. …

F1 · P1 a hostile repo can write any file in your home … fixed in 0.1.1

Fig. 1 Fair-test run 2 of 6, rerun on the pre-fix code. Verbatim; … marks a cut. Full report →

It found a real hole in our installer. So did a 76-word agent.

	Hand-written · 76 words	VoltAgent collection · 1,007 words	truecast · 12,697 words in 21 files
Hostile repo writes into your home	6 of 6	5 of 6	5 of 6
Hooks the install plan didn’t show	1 of 6	1 of 6	2 of 6
Unrestricted Bash, pre-approved	2 of 6	0 of 6	2 of 6
Total	9 of 18	6 of 18	9 of 18
Ended on GO or NO-GO	0 of 6	0 of 6	6 of 6
Average run	$0.85	$0.68	$1.04

The GO or NO-GO comes from our agent file; you could ask yours for one. A one-file agent, yours or a collection’s, stops there. Ours has a playbook behind it, your brief beside it, and updates you approve.

Fig. 2 Same prompt, six runs each, 2026-10-16. Model: claude-opus-5-5; 8 of 18 runs switched to claude-opus-4-8 partway. All 18 reports →

Behind each name, a playbook you can read.

security-engineer.md: the agent file, listed when you type @
its playbook: 21 files, 12,697 words. It can open any of them mid-job.
your brief: .truecast/agents/security-engineer/instance/mandate.md in your repo, once you add it. It reads this first.

updates replace the playbook · stop at your brief

Fig. 3 Open the folder on GitHub →

Each teammate is a native Claude Code subagent.

its context 66,578 tokens · 10 tool calls

your session gets 2,780 tokens: the report

Fig. 4 From an earlier review’s session log, to one scale. How we counted →

Two commands. A teammate is written only after you approve its plan.

terminal

1 Once, the installer

claude plugin install truecast --marketplace wastedcode/truecast
```
…
✔ Successfully installed plugin: truecast@truecast (scope: user)
```

in Claude Code

2 Once per teammate

/truecast:install security-engineer

Claude shows you the installer’s plan, then asks “Install it?”

plan: install security-engineer@1.2.2   (from your local marketplace copy)
  tools granted to @security-engineer: Read, Grep, Glob, Bash, WebSearch, WebFetch
  writes:
    craft    ~/.truecast/personas/security-engineer/1.2.2/core/
    …
    agent    ~/.claude/agents/security-engineer.md
  nothing has been written yet.

Claude Code already open? /reload-plugins first.

in Claude Code

Then use it

@agent-security-engineer review the changes on this branch before I merge

Or type @ and pick it. Missing? Restart Claude Code once.

Already in a session? /plugin install truecast --marketplace wastedcode/truecast (2.1.275 or later)

Your brief: start from the template →

No truecast server: it installs from the copy Claude Code cloned.

Update, remove, Windows: the docs →

Fig. 5 Output verbatim, 2026-10-17; home shown as ~; … marks a cut.

Twelve teammates. Pick the call you’d rather not make alone.

software-architectHow should this be built so it lasts?
software-engineerCan I trust this code?
qaWhat breaks before a user finds it?
security-engineerCan this get someone owned?
infrastructureWill this hold up in production?
product-managerAre we building the right thing?
product-researcherWhat are users telling us?
ui-ux-designerCan people use this?
brand-designerWould anyone remember us?
product-marketerWhy would anyone care?
salesWho would pay for this?
vc-seedWould an investor write the check?

/truecast:install <name>

Fig. 6 One band per file, one scale. Tested so far: security-engineer, product-marketer.

This page was written and built by two of them.

Fig. 7 Every hand-off, review and later change →

Before writing this, product-marketer was tested blind: four versions, two drafts each of our last homepage, scored by fresh Claude sessions. As shipped, it did no better than the bare model. With one rule added (have a fresh session check the work before handing off), all three judges ranked its drafts first and second. It still made more serious mistakes, and cost five times as much. That’s 1.6.0.

	as shipped	+ the rule	bare model	rewrite
mistakes per draft	10.0	7.8	9.8	7.8
serious ones	3.8	3.3	1.8	1.3
boldest-idea rank (1 is best)	4.3	1.5	6.0	6.2

Fig. 8 Every draft, score and rubric →

Put a specialist on the call you’re about to make.