SPS logo

SPS Dev Tool Guides

Shared AI infrastructure for the Sand Point Studios dev team

Claude Code skills

Use this to remember which skills exist, which ones we're not firing, and how to write our own. Verified 2026-08-23 against the plugin cache, marketplace registry and skills directories on Teagan's laptop. A designed version of this page is published as a private artifact — see the link at the bottom.


What a skill actually is

A folder with a SKILL.md in it. The frontmatter carries a name and a description; the body carries instructions. That is the whole format.

The mechanism worth understanding is when the body gets read. Every skill's description sits in context permanently — a few dozen tokens, always there, acting as a trigger. The instructions underneath only load when something matches. A rack of forty skills costs you forty descriptions, not forty manuals. That is why skills scale where stuffing everything into CLAUDE.md does not.

Two things fire a skill: the model matches your request against the description and loads it on its own, or you type /name and force it. Most built-in skills are written to fire automatically — you have probably been using artifact-design and dataviz for months without knowing their names.

What it is What it costs
Skill Instructions loaded into the turn you're already in. Same context, same conversation, no handoff. A page of tokens
Subagent A separate agent with its own context window that reports a summary back. Good for fan-out, expensive by design. A whole session
Slash command A saved prompt, expanded into your message. No conditional loading, no logic. The prompt

This matters for our bill. Subagent fan-out is our largest controllable overspend — the finding behind XDEC-103 and the reason the subagent-discipline rules exist. A lot of what we reach for a subagent to do is a skill's job: encoding a procedure we keep re-explaining. Reach for the skill first. It runs in the context you already paid for.


The rack — what's installed

Everything below is available right now, in your seat container and on your laptop both. Underused marks the ones we have and aren't firing.

Shipping code

Skill Does When Status
/code-review Reviews the current diff — or a PR number, branch, or path — for correctness bugs plus reuse and simplification cleanups. Effort scales lowmax. Add --comment to post inline PR comments, --fix to apply to your tree. Every branch touching a commercial surface. /code-review ultra runs a deep multi-agent review in the cloud — billed, self-triggered, worth it for a big merge only. In use
/security-review Security-specific pass over pending changes on the current branch. Hunts auth gaps, injection, secret handling, exposure — not style. Anything touching auth, RLS policies, Cloudflare Access, tunnels, webhook handlers, or a new public endpoint. We run a lot of tunneled subdomains against a home server. Underused
/simplify Reviews changed code for reuse, simplification, efficiency and altitude, then applies the fixes. Explicitly not bug-hunting. Right after the "it works now" moment, which is exactly when nobody wants to reread their own code. Pairs with /code-review; neither substitutes for the other. Underused
/run Launches and drives the project's app so a change is confirmed in the real thing, not just in tests. Any front-end change where "the tests pass" and "it looks right" are different claims. Underused
/init Generates a CLAUDE.md for a repo by reading it. Any repo you re-explain at the start of every session. Then edit it down hard — generated context nobody trims becomes noise. In use

Things people look at

Skill Does When Status
artifact-design Design fundamentals loaded before any artifact is written — palette, type pairing, both themes, layout, copy. Fires on its own. Worth knowing it exists so you can steer it — "make this more utilitarian" is a direction it understands. In use
dataviz A method for charts that read as one system — form heuristic, colour formula with a runnable validator, mark specs, interaction rules. Any medium: React, matplotlib, plotly, SVG, PNG. Say so before the chart exists. Raghav: every financial-analysis output. Teagan: the hygiene sweep and any briefing with numbers. Our charts are currently whatever the plotting library defaulted to, which is why no two match. Underused
artifact-diagramming When a diagram earns its place, how to draw one showing the real mechanism, and the inline-SVG mechanics that keep it legible in both themes. The fleet topology needs one. We describe the DeWitt/lakehouse split, the cross-site WAN hop to srv2 and the LiteLLM routing in prose every time, and it fails to land every time. Underused
artifact-capabilities Runtime powers a published artifact can be granted beyond static HTML — live or connected data, state shared between viewers, handing a viewer a file, self-updating. The difference between a status page that was true on Tuesday and one that's true now. Every dashboard we've published is the first kind. Underused
/design Builds a design canvas — multiple artboards on one pan-and-zoom surface, published as an artifact and refined visually where saving is enabled. Screen flows and mockups before anyone writes a component. Also posters, flyers and one-pagers. Underused

Automation and the harness

Skill Does When Status
/loop Runs a prompt or slash command on a repeating interval. Omit the interval and it paces itself. Watching a deploy, babysitting a migration, the overnight loop. Say the number — our cadence is 270s daytime / 60s overnight, not the 300–1200s it reaches for by default. In use
/schedule Creates, updates, lists and runs scheduled cloud agents on cron. Also one-time future runs. The one to investigate. The weekly portfolio hygiene sweep is laptop-only by necessity and dies when the laptop shuts. Cloud scheduling is the candidate fix — with the caveat that a cloud agent can't reach the tailnet or a locally-unlocked Bitwarden. Worth a session to find where that line falls. Underused
update-config Configures the harness through settings.json — permissions, env vars, hooks. Any time you ask for the same thing every session. The distinction that matters: "from now on, always X" is a hook, not a memory. The harness executes hooks; a preference in memory can be read and then not acted on. Our subagent-usage logging already works this way. Underused
/fewer-permission-prompts Scans your own transcripts for read-only Bash and MCP calls you approve repeatedly, then writes a prioritised allowlist into the project's .claude/settings.json. Now, in whatever repo annoys you most. Two minutes, and the allowlist is evidence-based rather than guessed. The targeted alternative to blanket bypass mode. Underused
keybindings-help Rebinding keys and adding chord shortcuts in ~/.claude/keybindings.json. Small, but nobody discovers it by accident. Minor

Reference and lookup

Skill Does When Status
claude-api Live reference for model IDs, pricing, parameters, streaming, tool use, MCP, prompt caching, token counting, migration. Fires automatically on LLM-shaped work. Every LiteLLM routing decision and every line of the Wyrdlyre inference costing. What matters is trusting it over recalled numbers — a remembered price is a wrong price. Underused
stripe:* Nine skills from the installed Stripe plugin: stripe-docs, stripe-best-practices, explain-error, test-cards, connect-recommend, upgrade-stripe and others. FinishOps billing and Wyrdlyre monetisation. stripe-docs beats a WebFetch — it reads the source, not a cached page. Installed

The shelf we haven't touched

The official marketplace is already registered on this machine. Only the Stripe plugin has ever been installed from it. These map onto problems we actually have.

Plugin What it brings Why us
skill-creator Create skills from scratch, edit existing ones, run evals, tune a description for trigger accuracy. Install this first. The section below is much slower without it.
session-report An explorable HTML report of session usage from local transcripts: tokens, cache hits, subagents, skills, expensive prompts. We manage subagent spend with a hand-rolled JSONL hook and a summary script. This is the same job done properly, with cache and per-skill breakdowns we don't have.
claude-md-management Audits every CLAUDE.md in a repo against a quality template, reports, then makes targeted fixes. 26 projects, uneven context files, a documented drift problem — global CLAUDE.md named a revoked Cloudflare token for weeks.
project-artifact A tabbed project status page — overview, workstreams, next steps, risks — published privately and refreshable at the same URL, reporting only the delta. Built for exactly the multi-workstream status updates we rewrite by hand. It re-gathers live state rather than restating a snapshot.
hookify Guidance and syntax for writing hook rules. Pairs with update-config. Once one "always do X" becomes a hook, the next four follow.
claude-security A fuller security menu — scan a whole repo or a scoped part, scan a diff or PR, or turn findings into verified patch files you apply when you choose. A step up from /security-review for a full-repo pass on the commercial surfaces.
receipts A personal usage-and-impact report from local transcripts, cross-referenced against git history. Useful when Max-plan spend needs justifying with something other than a feeling.

Also on the shelf: pr-review-toolkit, commit-commands, code-modernization, frontend-design, plugin-dev, mcp-server-dev, agent-sdk-dev, and language servers for TypeScript, Python, Ruby, Rust, Go, C# and Swift.

Installing

The marketplace is registered already, so this is one command per plugin. Restart Claude Code afterwards.

# see what a plugin adds, and what it costs you in context
claude plugin details skill-creator@claude-plugins-official

# install
claude plugin install skill-creator@claude-plugins-official
claude plugin install session-report@claude-plugins-official
claude plugin install claude-md-management@claude-plugins-official

# check what you have
claude plugin list

claude plugin details before install is the habit worth keeping — it prints the component inventory and the projected token cost, so you can see what a plugin does to your context budget before it does it.


Nobody here has written one

This is the finding. There is no ~/.claude/skills/ on this machine and no .claude/skills/ in any repo under C:\dev. Zero custom skills, across a fleet with a documented list of procedures we re-explain constantly.

Every one of these has already cost us something: the Bitwarden CLI quirk that silently burns a session, the duplicate TTS service deployed because nobody checked the capability registry, the access grant recorded in one project's memory store and therefore invisible to the seat agent that refused Lew. In each case the knowledge existed in dev-context and was not read at the moment it mattered.

That is the gap a skill closes. A document has to be found. A skill fires on the words you were already typing.

1. Decide where it lives

~/.claude/skills/<name>/SKILL.md is personal — your machine only, invisible to everyone else. <repo>/.claude/skills/<name>/SKILL.md is committed, so every seat container that clones the repo gets it.

For a three-person team, commit it. A procedure living on one laptop is the same failure mode as a grant living in one memory store.

2. Write the description as a trigger, not a summary

The description is the only part always in context, and it is doing one job: matching. Write the literal words someone would use — verbs, nouns, error strings, tool names. The shipped Stripe skills have descriptions running six lines of comma-separated triggers; that is not sloppiness, it is the format working correctly.

"Helps with secrets" never fires. "Use when retrieving a credential, API token, or password from Bitwarden, when bw get or bw list returns empty, or when a session needs a key from the SPS Service collection" fires every time.

Instructions in SKILL.md, longer references in sibling files the body points at. Same progressive-disclosure logic one level down.

---
name: bw-secret
description: Use when retrieving any credential, API token, password, or
  key from Bitwarden — including when `bw get` or `bw list` returns empty,
  when a command needs a secret from the SPS Service collection, or when
  BW_SESSION appears not to work. Covers the pipe-stdin workaround for
  bw 2026.4.1 and the custom-fields retrieval path.
allowed-tools: Bash, Read
---

# Retrieving a secret from Bitwarden

Bitwarden is already unlocked in every environment. Never ask Teagan,
Lew or Raghav to unlock it.

## The 2026.4.1 gotcha
`list` and `get` ignore both `BW_SESSION` and `--session`. Pipe the
master password to stdin instead. `bw status` reports `locked` even
after a successful unlock — ignore it.

## Keys live in custom fields
Use `bw get item <name>` and read `fields[]`. Do not assume the
credential is in the password field.

Full reference: ~/dev-context/bitwarden-cli-usage.md

name and description are the required pair. allowed-tools narrows what the skill may touch; disable-model-invocation: true makes it slash-command-only when you don't want it firing on its own.

Six worth writing first

Each is a procedure already written down somewhere in dev-context and already skipped at least once.

Skill Fires on Prevents
bw-secret Any credential retrieval; bw returning empty The session-burning 2026.4.1 quirk, rediscovered from scratch each time
fleet-capability-check TTS, STT, embeddings, vision, OCR, reranking, image generation, "add an LLM call" Building a capability the fleet already has. This has happened — a duplicate TTS service, 8 Aug
dev-context-decision "log this decision", "append to decisions" The half-done version: entry appended, index never rebuilt
sps-incident-report "write this up", "incident report" Re-deriving our report format and severity language every time
seat-provision "onboard", "new contributor", "give them access" A partial provision — Coder seat and Mattermost done, LiteLLM key or Bitwarden collection forgotten
sps-outbound-mail "email them", "send this to" Wrong From address, the 587 STARTTLS failure, skipping the draft-then-confirm gate

The natural home for the shared ones is a committed .claude/skills/ in Workstation Hub, which all three of us already have checked out.


House habits


Caveats

Verified against Teagan's laptop install on 2026-08-23 — not against Lew's or Raghav's seat containers, which may ship a different set if their Claude Code build is older. Run claude plugin list in your own environment to confirm.

The canonical, always-current sources are ~/dev-context/ and the intranet. Where this page and those disagree, those win.