Claude Code skills
Use this to remember which skills exist, which ones we're not firing, and how to write our own. Verified 2026-08-23 against the plugin cache, marketplace registry and skills directories on Teagan's laptop. A designed version of this page is published as a private artifact — see the link at the bottom.
What a skill actually is
A folder with a SKILL.md in it. The frontmatter carries a name and a description; the body
carries instructions. That is the whole format.
The mechanism worth understanding is when the body gets read. Every skill's description sits
in context permanently — a few dozen tokens, always there, acting as a trigger. The instructions
underneath only load when something matches. A rack of forty skills costs you forty descriptions,
not forty manuals. That is why skills scale where stuffing everything into CLAUDE.md does not.
Two things fire a skill: the model matches your request against the description and loads it on
its own, or you type /name and force it. Most built-in skills are written to fire automatically
— you have probably been using artifact-design and dataviz for months without knowing their
names.
| What it is | What it costs | |
|---|---|---|
| Skill | Instructions loaded into the turn you're already in. Same context, same conversation, no handoff. | A page of tokens |
| Subagent | A separate agent with its own context window that reports a summary back. Good for fan-out, expensive by design. | A whole session |
| Slash command | A saved prompt, expanded into your message. No conditional loading, no logic. | The prompt |
This matters for our bill. Subagent fan-out is our largest controllable overspend — the finding behind XDEC-103 and the reason the subagent-discipline rules exist. A lot of what we reach for a subagent to do is a skill's job: encoding a procedure we keep re-explaining. Reach for the skill first. It runs in the context you already paid for.
The rack — what's installed
Everything below is available right now, in your seat container and on your laptop both. Underused marks the ones we have and aren't firing.
Shipping code
| Skill | Does | When | Status |
|---|---|---|---|
/code-review |
Reviews the current diff — or a PR number, branch, or path — for correctness bugs plus reuse and simplification cleanups. Effort scales low → max. Add --comment to post inline PR comments, --fix to apply to your tree. |
Every branch touching a commercial surface. /code-review ultra runs a deep multi-agent review in the cloud — billed, self-triggered, worth it for a big merge only. |
In use |
/security-review |
Security-specific pass over pending changes on the current branch. Hunts auth gaps, injection, secret handling, exposure — not style. | Anything touching auth, RLS policies, Cloudflare Access, tunnels, webhook handlers, or a new public endpoint. We run a lot of tunneled subdomains against a home server. | Underused |
/simplify |
Reviews changed code for reuse, simplification, efficiency and altitude, then applies the fixes. Explicitly not bug-hunting. | Right after the "it works now" moment, which is exactly when nobody wants to reread their own code. Pairs with /code-review; neither substitutes for the other. |
Underused |
/run |
Launches and drives the project's app so a change is confirmed in the real thing, not just in tests. | Any front-end change where "the tests pass" and "it looks right" are different claims. | Underused |
/init |
Generates a CLAUDE.md for a repo by reading it. |
Any repo you re-explain at the start of every session. Then edit it down hard — generated context nobody trims becomes noise. | In use |
Things people look at
| Skill | Does | When | Status |
|---|---|---|---|
artifact-design |
Design fundamentals loaded before any artifact is written — palette, type pairing, both themes, layout, copy. | Fires on its own. Worth knowing it exists so you can steer it — "make this more utilitarian" is a direction it understands. | In use |
dataviz |
A method for charts that read as one system — form heuristic, colour formula with a runnable validator, mark specs, interaction rules. Any medium: React, matplotlib, plotly, SVG, PNG. | Say so before the chart exists. Raghav: every financial-analysis output. Teagan: the hygiene sweep and any briefing with numbers. Our charts are currently whatever the plotting library defaulted to, which is why no two match. | Underused |
artifact-diagramming |
When a diagram earns its place, how to draw one showing the real mechanism, and the inline-SVG mechanics that keep it legible in both themes. | The fleet topology needs one. We describe the DeWitt/lakehouse split, the cross-site WAN hop to srv2 and the LiteLLM routing in prose every time, and it fails to land every time. | Underused |
artifact-capabilities |
Runtime powers a published artifact can be granted beyond static HTML — live or connected data, state shared between viewers, handing a viewer a file, self-updating. | The difference between a status page that was true on Tuesday and one that's true now. Every dashboard we've published is the first kind. | Underused |
/design |
Builds a design canvas — multiple artboards on one pan-and-zoom surface, published as an artifact and refined visually where saving is enabled. | Screen flows and mockups before anyone writes a component. Also posters, flyers and one-pagers. | Underused |
Automation and the harness
| Skill | Does | When | Status |
|---|---|---|---|
/loop |
Runs a prompt or slash command on a repeating interval. Omit the interval and it paces itself. | Watching a deploy, babysitting a migration, the overnight loop. Say the number — our cadence is 270s daytime / 60s overnight, not the 300–1200s it reaches for by default. | In use |
/schedule |
Creates, updates, lists and runs scheduled cloud agents on cron. Also one-time future runs. | The one to investigate. The weekly portfolio hygiene sweep is laptop-only by necessity and dies when the laptop shuts. Cloud scheduling is the candidate fix — with the caveat that a cloud agent can't reach the tailnet or a locally-unlocked Bitwarden. Worth a session to find where that line falls. | Underused |
update-config |
Configures the harness through settings.json — permissions, env vars, hooks. |
Any time you ask for the same thing every session. The distinction that matters: "from now on, always X" is a hook, not a memory. The harness executes hooks; a preference in memory can be read and then not acted on. Our subagent-usage logging already works this way. | Underused |
/fewer-permission-prompts |
Scans your own transcripts for read-only Bash and MCP calls you approve repeatedly, then writes a prioritised allowlist into the project's .claude/settings.json. |
Now, in whatever repo annoys you most. Two minutes, and the allowlist is evidence-based rather than guessed. The targeted alternative to blanket bypass mode. | Underused |
keybindings-help |
Rebinding keys and adding chord shortcuts in ~/.claude/keybindings.json. |
Small, but nobody discovers it by accident. | Minor |
Reference and lookup
| Skill | Does | When | Status |
|---|---|---|---|
claude-api |
Live reference for model IDs, pricing, parameters, streaming, tool use, MCP, prompt caching, token counting, migration. Fires automatically on LLM-shaped work. | Every LiteLLM routing decision and every line of the Wyrdlyre inference costing. What matters is trusting it over recalled numbers — a remembered price is a wrong price. | Underused |
stripe:* |
Nine skills from the installed Stripe plugin: stripe-docs, stripe-best-practices, explain-error, test-cards, connect-recommend, upgrade-stripe and others. |
FinishOps billing and Wyrdlyre monetisation. stripe-docs beats a WebFetch — it reads the source, not a cached page. |
Installed |
The shelf we haven't touched
The official marketplace is already registered on this machine. Only the Stripe plugin has ever been installed from it. These map onto problems we actually have.
| Plugin | What it brings | Why us |
|---|---|---|
skill-creator |
Create skills from scratch, edit existing ones, run evals, tune a description for trigger accuracy. | Install this first. The section below is much slower without it. |
session-report |
An explorable HTML report of session usage from local transcripts: tokens, cache hits, subagents, skills, expensive prompts. | We manage subagent spend with a hand-rolled JSONL hook and a summary script. This is the same job done properly, with cache and per-skill breakdowns we don't have. |
claude-md-management |
Audits every CLAUDE.md in a repo against a quality template, reports, then makes targeted fixes. |
26 projects, uneven context files, a documented drift problem — global CLAUDE.md named a revoked Cloudflare token for weeks. |
project-artifact |
A tabbed project status page — overview, workstreams, next steps, risks — published privately and refreshable at the same URL, reporting only the delta. | Built for exactly the multi-workstream status updates we rewrite by hand. It re-gathers live state rather than restating a snapshot. |
hookify |
Guidance and syntax for writing hook rules. | Pairs with update-config. Once one "always do X" becomes a hook, the next four follow. |
claude-security |
A fuller security menu — scan a whole repo or a scoped part, scan a diff or PR, or turn findings into verified patch files you apply when you choose. | A step up from /security-review for a full-repo pass on the commercial surfaces. |
receipts |
A personal usage-and-impact report from local transcripts, cross-referenced against git history. | Useful when Max-plan spend needs justifying with something other than a feeling. |
Also on the shelf: pr-review-toolkit, commit-commands, code-modernization, frontend-design,
plugin-dev, mcp-server-dev, agent-sdk-dev, and language servers for TypeScript, Python, Ruby,
Rust, Go, C# and Swift.
Installing
The marketplace is registered already, so this is one command per plugin. Restart Claude Code afterwards.
# see what a plugin adds, and what it costs you in context
claude plugin details skill-creator@claude-plugins-official
# install
claude plugin install skill-creator@claude-plugins-official
claude plugin install session-report@claude-plugins-official
claude plugin install claude-md-management@claude-plugins-official
# check what you have
claude plugin list
claude plugin details before install is the habit worth keeping — it prints the component
inventory and the projected token cost, so you can see what a plugin does to your context
budget before it does it.
Nobody here has written one
This is the finding. There is no ~/.claude/skills/ on this machine and no .claude/skills/ in
any repo under C:\dev. Zero custom skills, across a fleet with a documented list of
procedures we re-explain constantly.
Every one of these has already cost us something: the Bitwarden CLI quirk that silently burns a session, the duplicate TTS service deployed because nobody checked the capability registry, the access grant recorded in one project's memory store and therefore invisible to the seat agent that refused Lew. In each case the knowledge existed in
dev-contextand was not read at the moment it mattered.That is the gap a skill closes. A document has to be found. A skill fires on the words you were already typing.
1. Decide where it lives
~/.claude/skills/<name>/SKILL.md is personal — your machine only, invisible to everyone else.
<repo>/.claude/skills/<name>/SKILL.md is committed, so every seat container that clones the repo
gets it.
For a three-person team, commit it. A procedure living on one laptop is the same failure mode as a grant living in one memory store.
2. Write the description as a trigger, not a summary
The description is the only part always in context, and it is doing one job: matching. Write the literal words someone would use — verbs, nouns, error strings, tool names. The shipped Stripe skills have descriptions running six lines of comma-separated triggers; that is not sloppiness, it is the format working correctly.
"Helps with secrets" never fires. "Use when retrieving a credential, API token, or password from
Bitwarden, when bw get or bw list returns empty, or when a session needs a key from the SPS
Service collection" fires every time.
3. Keep the body short and link out
Instructions in SKILL.md, longer references in sibling files the body points at. Same
progressive-disclosure logic one level down.
---
name: bw-secret
description: Use when retrieving any credential, API token, password, or
key from Bitwarden — including when `bw get` or `bw list` returns empty,
when a command needs a secret from the SPS Service collection, or when
BW_SESSION appears not to work. Covers the pipe-stdin workaround for
bw 2026.4.1 and the custom-fields retrieval path.
allowed-tools: Bash, Read
---
# Retrieving a secret from Bitwarden
Bitwarden is already unlocked in every environment. Never ask Teagan,
Lew or Raghav to unlock it.
## The 2026.4.1 gotcha
`list` and `get` ignore both `BW_SESSION` and `--session`. Pipe the
master password to stdin instead. `bw status` reports `locked` even
after a successful unlock — ignore it.
## Keys live in custom fields
Use `bw get item <name>` and read `fields[]`. Do not assume the
credential is in the password field.
Full reference: ~/dev-context/bitwarden-cli-usage.md
name and description are the required pair. allowed-tools narrows what the skill may touch;
disable-model-invocation: true makes it slash-command-only when you don't want it firing on its own.
Six worth writing first
Each is a procedure already written down somewhere in dev-context and already skipped at least once.
| Skill | Fires on | Prevents |
|---|---|---|
bw-secret |
Any credential retrieval; bw returning empty |
The session-burning 2026.4.1 quirk, rediscovered from scratch each time |
fleet-capability-check |
TTS, STT, embeddings, vision, OCR, reranking, image generation, "add an LLM call" | Building a capability the fleet already has. This has happened — a duplicate TTS service, 8 Aug |
dev-context-decision |
"log this decision", "append to decisions" | The half-done version: entry appended, index never rebuilt |
sps-incident-report |
"write this up", "incident report" | Re-deriving our report format and severity language every time |
seat-provision |
"onboard", "new contributor", "give them access" | A partial provision — Coder seat and Mattermost done, LiteLLM key or Bitwarden collection forgotten |
sps-outbound-mail |
"email them", "send this to" | Wrong From address, the 587 STARTTLS failure, skipping the draft-then-confirm gate |
The natural home for the shared ones is a committed .claude/skills/ in Workstation Hub,
which all three of us already have checked out.
House habits
- Skill before subagent. If the answer is "a procedure we keep re-explaining," that's a skill and it's nearly free. Spawn an agent when the work genuinely needs its own context window — a broad search, real parallelism — not to carry instructions.
- Descriptions are the surface. A skill that never fires is worse than no skill, because you think it's covered. If one isn't triggering, the description is wrong — add the literal phrases you actually type.
- Commit them. Personal skills solve your problem once. A skill in a repo's
.claude/skills/reaches every seat container the moment they pull. - Don't skill a one-off. Third time you explain the same thing, write it down. Not the first.
- Check the cost.
claude plugin details <name>shows projected token cost before you install. A plugin you never use still spends its descriptions on every turn. - Say the number. Skills carry defaults you may not want —
/loopreaches for 300–1200s when our cadence is 270s daytime and 60s overnight. State the constraint rather than accepting the default.
Caveats
Verified against Teagan's laptop install on 2026-08-23 — not against Lew's or Raghav's seat
containers, which may ship a different set if their Claude Code build is older. Run
claude plugin list in your own environment to confirm.
The canonical, always-current sources are ~/dev-context/ and the intranet. Where this page and
those disagree, those win.