Skills System & SKILL.md

~18 min · skills, skill-md, frontmatter, auto-invocation

Level 0🌱 Novice

0 XP0/70 lessons0/11 achievements

0/120 XP to next level120 XP to go0% complete

Skills are commands with frontmatter and friends

A custom slash command is a single markdown file. A Skill is the same thing with structure — frontmatter for configuration, a folder for supporting files, and an opt-in to auto-invocation. Both produce a /skill-name; Skills add reach.

The frontmatter knobs that matter: invocation: explicit|auto|disabled controls when Claude can use the skill. arguments: declares named args you reference as {{name}}. paths: loads supporting files into the skill's context. model: overrides the model for that skill alone. subagent: true runs the skill in an isolated context window.

The bundled Skills are the best way to learn the pattern: /batch orchestrates parallel refactors across worktrees, /simplify reduces complexity without changing behavior, /loop runs prompts on a schedule inside the session, /debug turns up logging, /claude-api auto-loads the SDK reference when it sees an Anthropic SDK import.

Code

A SKILL.md that auto-invokes·markdown

---
name: security-audit
description: |
  OWASP-aware security audit of a file or directory.
  Auto-invoked when the user asks about "security" or "vulnerabilities".
invocation: auto
arguments:
  - name: target
    description: File or directory to audit
    required: true
paths:
  - checklists/owasp-top10.md
model: claude-opus-4-7
subagent: true
---

You are a senior application security engineer. Audit {{target}} for:

1. SQL injection vulnerabilities
2. XSS attack vectors
3. Authentication / authorization flaws
4. Sensitive data exposure
5. Insecure direct object references

Reference checklists/owasp-top10.md. Output:
[SEVERITY] Description — File:Line — Remediation

Skill folder layout·text

.claude/
└── skills/
    └── security-audit/
        ├── SKILL.md
        ├── checklists/
        │   └── owasp-top10.md
        └── remediation-templates/
            ├── sql-injection.md
            └── xss.md

External links

Exercise

Build a Skill for a task you'd happily delegate (security audit, perf review, doc generator, anything). Frontmatter must include description, arguments, and invocation. Run it with explicit invocation first, prove it works, then promote to auto.

Progress

Progress is local-only — sign in to sync across devices.

← PreviousSlash Commands & /init, /compact, /cost, /effort Next →Custom Subagents & /agents

Spotted a bug or have feedback on this page?Report an Issue

Comments 0

🔔 Reply notifications (sign in)

No comments yet — be the first.