Claude skills

What is a skill?

A skill is a markdown file containing knowledge, workflows or instructions. You can invoke a skill with a command like /deploy or Claude can load them automatically when a skill matches the current prompt.

When to create a skill?

When you want to automate a common prompt or task. Examples:

• /review-endpoint <endpoint-path>: skill for reviewing a new API endpoint to ensure it has proper validation checks, security enforcements and automated tests.
• /security-review <git-branch>: skill for reviewing security vulnerabilities and identifying authentication or authorization gaps.

Example 1: security-review <branch>

Consider an example skills/security-review/ folder:

skills/
  security-review/
    SKILL.md
    checklist.md

Suppose its SKILL.md file looked like this:

---
description: Reviews code changes for security vulnerabilities, authentication gaps, and injection risks
disable-model-invocation: true
argument-hint: <branch-or-path>
---

## Diff to review

!`git diff $ARGUMENTS`

Audit the changes above for:

1. Injection vulnerabilities (SQL, XSS, command)
2. Authentication and authorization gaps
3. Hardcoded secrets or credentials

Use checklist.md in this skill directory for the full review checklist.

Report findings with severity ratings and remediation steps.

This skill uses disable-model-invocation: true which means only you can trigger it; Claude never invokes it on its own.

The !<code> line runs a shell command and injects its output into the prompt.

$ARGUMENTS substitues whatever you typed after the skill name. For example, if you typed /security-review feature/add-login, Claude will essentially run git diff feature/add-login.

Example 2: /fix-issue <number>

---
argument-hint: <issue-number>
---

!`gh issue view $ARGUMENTS`

Investigate and fix the issue above.

1. Trace the bug to its root cause
2. Implement the fix
3. Write or update tests
4. Summarize what you changed and why