NIST
NIST AI RMF Map Function: How to Identify AI Risks
Learn how NIST Map and MAP 1-5 establish AI system context and help identify risks, benefits, components, limitations and potential...
Claude Skills are reusable packages of instructions, workflows, scripts, and reference materials that help Claude complete specialized tasks more consistently. Instead of pasting the same procedure into every conversation, users can install or create a Skill that Claude loads when it matches the task.
The best Claude Skills include built-in document capabilities, bundled Claude Code Skills for reviewing and debugging software, official plugins for creating and testing Skills, and focused custom Skills for research, writing, productivity, and company procedures.
This guide explains what Claude Skills are, which options are most useful, how Claude Code Skills work, how to install or create them, and how to evaluate third-party Skills safely.
People asking “what are Skills in Claude?” are usually trying to understand how they differ from normal prompts and where they can be used.
A Claude Skill is a folder containing specialized instructions and optional supporting resources. Claude can identify a relevant Skill from its description, load its instructions, and use its scripts, references, or assets when required.
Skills are available across several Claude environments, but the way users add and manage them differs.
|
Claude environment |
How Skills are used |
|
Claude |
Enable, browse, or upload Skills through Customize > Skills |
|
Claude Code |
Add filesystem-based Skills or install plugin-distributed Skills |
|
Claude API and managed agents |
Attach supported pre-built or custom Skills programmatically |
|
Team and Enterprise environments |
Use personal, shared, or organization-provisioned Skills where enabled |
Anthropic currently describes Skills as available to Free, Pro, Max, Team, and Enterprise Claude users when the required capabilities are enabled. Its Help Center describes Claude Code Skills as being available in beta, so users should confirm current availability before relying on a particular workflow.
Every portable Agent Skill is built around a SKILL.md file containing YAML frontmatter and Markdown instructions.
Under the current Agent Skills specification, the two required frontmatter fields are:
name: A lowercase identifier using letters, numbers, and hyphens
description: A clear explanation of what the Skill does and when it should be used
The Markdown body tells Claude how to perform the task. It can contain steps, decision rules, expected outputs, examples, quality requirements, and guidance for handling missing or ambiguous information.
A Skill can also contain supporting resources:
my-skill/
├── SKILL.md
├── scripts/
├── references/
└── assets/
The scripts/ directory can contain executable utilities. The references/ directory can contain standards, documentation, checklists, or domain knowledge. The assets/ directory can contain templates, images, schemas, and other static resources.
Only SKILL.md is essential. Additional resources should be included only when they materially support the workflow.
The basic process is:
A user submits a request.
Claude checks the names and descriptions of available Skills.
Claude identifies a relevant Skill, or the user invokes one directly.
Claude loads the Skill’s instructions.
Supporting files are accessed when required.
Claude performs the task using the Skill’s workflow and available tools.
In Claude Code, an available Skill can usually be invoked directly with:
/skill-name
Plugin-distributed Skills use a namespace:
/plugin-name:skill-name
Claude may also load a Skill automatically when its description matches the request. Automatic selection is not guaranteed to be perfect, so important workflows should be tested with expected, unexpected, and borderline requests.
Skills for Claude can support coding, debugging, testing, research, writing, data analysis, document processing, presentations, spreadsheets, planning, and specialized business procedures.
A coding Skill might define repository conventions or a required review sequence. A research Skill could establish source-selection and citation rules. A writing Skill might encode brand voice, approved terminology, and editing standards.
Skills can also support standard operating procedures in marketing, SEO, finance, security, compliance, and legal operations. However, a Skill provides procedural guidance. It does not replace professional judgment, system permissions, external integrations, or human approval.
Prompts, Skills, MCP, and plugins solve different problems. They can work together, but they are not interchangeable.
|
Option |
Primary purpose |
Best suited to |
|
Prompt |
Provides instructions within an interaction |
One-time or highly specific tasks |
|
Claude Skill |
Packages reusable instructions and resources |
Repeated specialized workflows |
|
MCP |
Connects Claude to external tools and data |
APIs, databases, services, and business systems |
|
Plugin |
Packages and distributes Claude Code extensions |
Sharing Skills, agents, hooks, and integrations |
A prompt tells Claude what to do in a particular interaction. A Skill teaches Claude how to handle a recognizable category of work repeatedly.
The Model Context Protocol gives Claude access to external tools, databases, APIs, and services. For example, an MCP server can connect Claude Code to an issue tracker. A Skill can then explain how Claude should triage and process those issues.
The Claude Code MCP documentation describes MCP as the connection layer for external tools and data sources. It does not serve the same purpose as a Skill.
A Claude Code plugin is a distribution package. It can include Skills, agents, hooks, MCP servers, language-server configurations, or other components. Installing a plugin may therefore add several capabilities rather than one isolated Skill.
Use a Skill when the same procedure, checklist, reference material, or output standard is needed repeatedly.
Strong use cases include code-review standards, debugging procedures, testing requirements, research methods, brand guidelines, document workflows, release checks, and team reporting processes.
A Skill is especially useful when a long procedure would otherwise be pasted into multiple conversations or placed permanently in project instructions.
A direct prompt is usually sufficient for a short, one-time request that is unlikely to be repeated.
A Skill is also not a replacement for an external connection. If Claude needs to retrieve data from another service, MCP or another integration may be required. If a process must execute automatically in response to an event, a hook, scheduled task, or external automation may be more appropriate.
The best Claude Skills have a clear purpose, reliable instructions, useful documentation, manageable dependencies, appropriate security controls, and compatibility with the intended Claude environment.
The following shortlist combines bundled Claude Code Skills, Anthropic document capabilities, official plugins, Anthropic-published examples, and custom workflow categories.
|
Skill or workflow |
Type |
Best for |
Example request |
|
/code-review |
Bundled Claude Code Skill |
Reviewing code changes |
“Review my changes for correctness, security, and missing tests.” |
|
/debug |
Bundled Claude Code Skill |
Investigating software problems |
“Debug this failing authentication flow and identify the root cause.” |
|
/run and /verify |
Bundled Claude Code Skills |
Running and validating applications |
“Run the application and verify that the new checkout flow works.” |
|
skill-creator |
Official plugin |
Creating and evaluating Skills |
“Evaluate my API documentation Skill for trigger accuracy.” |
|
|
Anthropic document Skill |
PDF creation and processing |
“Extract the tables from this PDF and organize the findings.” |
|
docx |
Anthropic document Skill |
Word document workflows |
“Turn these notes into a professionally formatted report.” |
|
pptx |
Anthropic document Skill |
Presentation creation |
“Create a concise presentation from this project summary.” |
|
xlsx |
Anthropic document Skill |
Spreadsheet analysis |
“Create a spreadsheet with formulas and a summary chart.” |
|
frontend-design |
Anthropic-published example |
Frontend design workflows |
“Create a responsive interface for this application.” |
|
webapp-testing |
Anthropic-published example |
Web application testing |
“Test this application and report reproducible failures.” |
|
Custom research Skill |
Custom |
Evidence-based research |
“Research this topic using our approved source hierarchy.” |
|
Custom brand Skill |
Custom |
Consistent content and design |
“Edit this article using our editorial and terminology rules.” |
A bundled Skill, an Anthropic-published example, and a community Skill do not have the same status. Users should confirm where a Skill comes from, what it installs, and whether it has been tested for their environment.
Claude Code currently documents bundled Skills including /code-review, /debug, /run, /verify, /batch, /loop, and /claude-api. The exact list can depend on the installed Claude Code version and enabled features.
/code-review is one of the strongest general choices because reviewing changes is frequent, bounded, and easy to evaluate.
/debug is useful when a failure needs a structured investigation rather than another speculative code change.
/run and /verify are valuable after implementation. They focus on launching the software and confirming behavior in the running application rather than relying only on static analysis or unit tests.
The official plugin ecosystem also includes development-oriented options. Anthropic documents commit-commands for Git workflows, pr-review-toolkit for pull-request review, security-guidance for identifying common vulnerabilities, and plugin-dev for plugin development. Some are plugins containing multiple Skills or agents, not standalone Skills.
Anthropic’s public Skills repository includes examples such as frontend-design, webapp-testing, and mcp-builder. These should be described as Anthropic-published examples unless current documentation identifies them as bundled or maintained product capabilities.
Once an AI-assisted application has been created and tested, deployment introduces a different set of technical decisions. AGC’s guide to deploying a vibe-coded website explains how to identify the project architecture, test a production build, protect environment variables, select compatible hosting, and verify the live application.
There is no single research Skill that is best for every topic. Research quality depends on the source hierarchy, geographical scope, date range, evidence requirements, and expected output.
A strong custom research Skill can define:
Sources that should receive priority
Sources that should not be treated as authoritative
How recent information must be
How conflicting evidence should be handled
Which claims require citations
How uncertainty should be disclosed
The required structure of the final output
Claude Code’s documentation includes an example of a research-style Skill that uses a separate context for codebase exploration. This demonstrates an authoring pattern rather than proving the existence of a universal research product.
Document Skills can support research involving PDFs, Word files, presentations, or spreadsheets. When live databases or external services are required, MCP can provide access while the Skill defines the research method.
Custom writing Skills are valuable when content must follow consistent editorial, brand, or documentation rules.
A writing Skill can define its target audience, brand voice, approved terminology, prohibited phrases, article structure, citation expectations, formatting requirements, and final editorial checks.
Anthropic’s public repository includes examples such as doc-coauthoring, brand-guidelines, and internal-comms. These show how Skills can support collaborative writing, brand consistency, and internal communication. They should be inspected and adapted to the organization’s actual requirements.
A practical request might be:
“Use our brand Skill to rewrite this product page, preserve all verified claims, and flag wording that conflicts with our approved terminology.”
Anthropic provides built-in document Skills for supported Claude users:
|
Skill |
Main use |
|
|
Creating, extracting, completing, and processing PDF files |
|
docx |
Creating and editing Word documents |
|
pptx |
Building and editing presentations |
|
xlsx |
Creating and analyzing spreadsheets |
Anthropic’s Help Center identifies enhanced Excel, Word, PowerPoint, and PDF capabilities as built-in Skills. Reference implementations are also published in the Anthropic Skills repository.
Users should distinguish between capabilities enabled inside Claude and repository versions installed through Claude Code. The environment, installation method, dependencies, and resulting behavior may differ.
For a broader explanation of how AI can support spreadsheet work, evidence synthesis, and professional research, see AI for Excel, Data Analysis and Workplace Research.
The most effective productivity Skills usually reflect the user’s actual process rather than a generic productivity method.
A personal Skill can define a preferred planning, prioritization, or reporting format. A project Skill can explain how to prepare release notes, organize issues, update a decision log, or create a project handoff.
Teams should prefer separate, focused Skills for planning, reporting, and project procedures. This makes each Skill easier to trigger, test, maintain, and disable.
Specialized work is where custom Skills often provide the greatest value.
A marketing Skill might define campaign-brief requirements and approval steps. An SEO Skill can specify search-intent analysis, source verification, internal linking, and metadata standards. A security Skill might apply an organization’s secure-coding checklist.
Finance, compliance, and legal Skills can structure analysis or standardize documentation, but they should not be presented as substitutes for qualified review.
Organizations developing internal Skills should connect them to wider governance controls. An AI governance framework can define ownership, approval, acceptable use, risk assessment, documentation, monitoring, and accountability across AI-assisted workflows.
The most dependable starting points are Skills bundled with Claude Code, capabilities maintained within Claude products, and resources published through official Anthropic channels.
Claude users can browse available options through Customize > Skills. Depending on the plan and organization settings, the directory may include Anthropic Skills, personally uploaded Skills, shared or organization-provisioned Skills, and partner Skills designed to work with relevant integrations.
Anthropic also maintains the public anthropics/skills repository, which contains document Skills, development examples, creative examples, enterprise workflows, and Skill-authoring resources.
Publication in an official repository does not eliminate the need for testing. Some repository content serves as a reference implementation, and behavior may differ from capabilities available directly inside Claude.
Community Skills are created by third parties and distributed through repositories, plugin collections, or marketplaces.
Claude Code supports an official Anthropic marketplace, a community marketplace, and independently distributed marketplaces. Anthropic says plugins in its community marketplace receive automated validation and safety screening, but that does not guarantee that every Skill is suitable for every user or production environment.
Community Skills can be useful when their purpose is focused, their instructions are transparent, and their dependencies are documented.
Read the complete SKILL.md before enabling the Skill. Confirm that the instructions match the public description and that the workflow is understandable.
Review every bundled script, executable, dependency file, configuration file, and supporting resource. Look for unexpected network requests, credential access, destructive commands, obfuscated code, broad file access, or instructions that install additional software.
Check repository activity, recent releases, unresolved issues, maintainers, and licensing. Popularity can provide context, but it is not a security audit.
Test an unfamiliar Skill using non-sensitive files and a disposable environment before allowing it to interact with production repositories or business data.
Claude Code Skills are reusable, filesystem-based instructions and resources that extend Claude Code workflows. Developers use them to preserve repository-specific procedures, coding conventions, review methods, testing requirements, debugging sequences, and release checks.
Skills can be invoked directly or selected by Claude when their descriptions match the request.
A Claude Code Skill can combine written instructions with supporting files and tool use.
For example, a Skill might instruct Claude to read a testing standard, run a validation script, inspect the report, and return findings in a prescribed format.
Claude Code also supports implementation-specific options beyond the portable Agent Skills standard. These include invocation controls, arguments, dynamic context injection, and separate subagent execution. A Skill that depends on Claude Code-specific fields may not behave identically in another compatible product.
Current Claude Code documentation defines these source locations:
|
Skill scope |
Source structure |
Availability |
|
Personal |
~/.claude/skills/<skill-name>/SKILL.md |
All projects for that user |
|
Project |
.claude/skills/<skill-name>/SKILL.md |
The current project |
|
Plugin |
<plugin>/skills/<skill-name>/SKILL.md |
Wherever the plugin is enabled |
|
Enterprise |
Managed through organizational settings |
Managed users |
The plugin path describes how a plugin author organizes a Skill. Claude Code manages marketplace-installed plugins through its plugin system and local cache. Users should manage installed plugins through /plugin rather than editing cached copies.
Claude Code can also discover Skills in nested .claude/skills/ directories when working with files in those directories. This is useful for package-specific workflows in a monorepository.
|
Type |
Best use |
Main advantage |
|
Personal Skill |
Individual preferences used across repositories |
Available across projects |
|
Project Skill |
Codebase or team-specific procedures |
Can be committed with the project |
|
Plugin Skill |
Versioned and distributable workflows |
Easier installation and reuse |
When standalone Skills share a name, Claude Code currently gives enterprise Skills precedence over personal Skills, and personal Skills precedence over project Skills. Plugin Skills use namespaced commands, which prevents those names from directly conflicting with standalone Skills.
People searching for how to add Skills to Claude Code have three primary options: install a plugin, add a personal Skill, or create a project Skill.
The instructions below reflect the current Claude Code Skills documentation and should be rechecked if Claude Code has changed since publication.
Claude Code normally adds the official Anthropic marketplace automatically.
To install Anthropic’s official skill-creator plugin, run this inside Claude Code:
/plugin install skill-creator@claude-plugins-official
If Claude Code reports that the official marketplace is unavailable, add it and retry:
/plugin marketplace add anthropics/claude-plugins-official
/plugin install skill-creator@claude-plugins-official
If the installation summary requests a reload, run:
/reload-plugins
Anthropic also distributes its public document and example Skills through the anthropics/skills repository:
/plugin marketplace add anthropics/skills
/plugin install document-skills@anthropic-agent-skills
Review the plugin details before confirming installation. The official plugin installation guide explains marketplace sources, installation scopes, plugin details, and reload behavior.
Create a directory under the personal Skills location:
mkdir -p ~/.claude/skills/code-quality-check
Use this structure:
~/.claude/skills/
└── code-quality-check/
└── SKILL.md
A personal Skill is available across that user’s projects.
Claude Code watches existing Skill directories for changes. If the top-level Skills directory did not exist when the session began, restart Claude Code so the new directory can be detected.
Create the Skill inside the repository:
mkdir -p .claude/skills/code-quality-check
Use this structure:
project-root/
└── .claude/
└── skills/
└── code-quality-check/
└── SKILL.md
Project Skills can be committed to version control and shared with collaborators. Before committing, check that the Skill contains no credentials, private local paths, confidential examples, or environment-specific secrets.
Run the following command inside Claude Code:
/skills
Users can also type / and search for the Skill.
Invoke a personal or project Skill with:
/code-quality-check
Plugin Skills use namespaced commands:
/plugin-name:skill-name
If a plugin Skill does not appear, inspect the installation through /plugin and run /reload-plugins when requested by the installation summary.
Once specialized workflows begin turning ideas into functioning software, the next step is understanding how AI-assisted development works more broadly. AGC’s AI Vibe Coding: Build Apps Without Traditional Coding course introduces AI-powered app creation, testing, automation, deployment, security, and responsible development without assuming a traditional programming background.
Creating a Claude Skill requires a directory, a valid SKILL.md file, focused instructions, and realistic testing.
Choose a short name representing one recognizable capability:
mkdir -p ~/.claude/skills/api-documentation
For compatibility with the Agent Skills standard, use lowercase letters, numbers, and single hyphens. The frontmatter name should match the directory name.
A minimal portable example is:
---
name: api-documentation
description: Creates and reviews API documentation from source code. Use when the user asks to document endpoints, request fields, responses, authentication, errors, or API examples.
---
# API Documentation
1. Inspect the relevant source files and existing documentation.
2. Identify endpoints, parameters, authentication, responses, and errors.
3. Do not infer behavior that is not supported by the code.
4. Follow the repository's existing documentation format.
5. Report missing or ambiguous implementation details separately.
For a portable Agent Skill, include both name and description. Claude Code can derive some information from the directory or file content, but portable Skills should follow the open specification.
Effective Skill instructions define the purpose, trigger conditions, required inputs, workflow, expected output, quality requirements, error handling, and relevant examples.
Tell Claude how to handle missing information. If the Skill analyzes source code, require it to separate verified behavior from inference. If it modifies files, define the checks required before and after editing.
A larger Skill might use:
api-documentation/
├── SKILL.md
├── scripts/
│ └── validate_examples.py
├── references/
│ └── documentation-standard.md
└── assets/
└── endpoint-template.md
Document the dependencies required by scripts. Reference supporting files from SKILL.md so Claude knows when to use them.
The Agent Skills specification recommends keeping supporting references focused and avoiding deeply nested chains of files.
A narrowly scoped Skill is easier to describe, trigger, test, secure, and update.
Combining research, writing, deployment, security review, and project management into one Skill creates unclear activation rules. Separate those responsibilities so each Skill has an identifiable purpose and measurable output.
The description helps Claude decide whether a Skill matches the user’s request.
“Helps with documentation” is vague. A stronger description is:
“Creates and reviews API documentation from source code. Use when the user requests endpoint documentation, authentication details, request schemas, response examples, or error references.”
Place the main capability and activation conditions in the description rather than hiding them only in the Skill body.
Agent Skills use three levels of information:
Name and description metadata
Core instructions in SKILL.md
Supporting resources accessed when required
The standard recommends keeping the main file under 500 lines and moving detailed material into focused supporting files. This limits unnecessary context use while preserving access to deeper instructions.
Test whether the Skill activates correctly and whether its output improves the result.
Use requests that should trigger the Skill, requests that should not trigger it, borderline requests, missing-input cases, and tests for unsafe or unexpected behavior.
Run tests in fresh sessions so earlier authoring context does not conceal missing instructions.
Anthropic’s official skill-creator plugin can support evaluation, trigger testing, comparison, and description refinement.
Skills with nearly identical descriptions can create routing ambiguity.
A broad “code quality” Skill may overlap with separate review, testing, debugging, and security Skills. Give each Skill a distinct purpose and explain the boundary when related Skills must coexist.
Skills should be treated as workflow components that may influence real tool use. A Skill can contain scripts, dependencies, network instructions, and procedures involving files or external systems.
Before installing a Skill, review:
The complete SKILL.md
Bundled scripts and executables
Package and dependency files
Network requests
Downloaded resources
File-system access
Tool permissions
Credential handling
Maintenance history
Anthropic identifies prompt injection and data exfiltration as significant Skill risks and recommends installing Skills only from trusted sources. Claude Code documentation also warns that plugins can execute arbitrary code with the user’s privileges.
Unapproved Claude Skills, plugins, or connected AI tools can also become part of a wider organizational visibility problem. AGC’s guide to Shadow AI cybersecurity risks explains how unmanaged AI tools can expose data, credentials, code, integrations, and business systems.
Test third-party Skills using non-sensitive files and limited access before production use. Review updates before enabling them in important environments.
Claude Code supports optional allowed-tools frontmatter that can preapprove listed tools during the invoking turn. It does not function as a security sandbox or necessarily prevent access to other tools governed by separate permissions. The open Agent Skills standard currently describes this field as experimental because support can vary between implementations.
Installing too many Skills: Large collections increase maintenance and can make selection less clear.
Writing vague descriptions: Claude cannot reliably select a Skill when its capability and trigger conditions are unclear.
Making one Skill do everything: Broad Skills are difficult to test, secure, and maintain.
Duplicating instructions: Repeated rules can drift apart or conflict.
Ignoring security: Skills may contain code, dependencies, and instructions with real access implications.
Not testing trigger behavior: Successful manual invocation does not prove that Claude will select the Skill correctly.
Using outdated installation instructions: Claude Code evolves quickly, so paths and commands should be checked against current documentation.
Confusing Skills with MCP: Skills provide procedures. MCP provides connections to external systems.
Copying unknown Skills without inspection: Repository popularity does not establish safety.
Failing to maintain Skills: Commands, dependencies, policies, and business processes change over time.
Developers should begin with focused code-review, debugging, testing, and application-verification Skills. Researchers should use Skills that define source standards, evidence checks, citation rules, and structured synthesis.
Content professionals benefit from editorial, brand, document, and research Skills. Teams should use project Skills for repository-specific procedures and plugins when a workflow needs structured distribution or versioning.
Advanced Claude Code users can create custom Skills that combine focused instructions with scripts, references, and existing tools.
The best Claude Skills are not necessarily the largest or most popular. The best Claude Skill is the one that reliably improves a repeated workflow without introducing unnecessary complexity or risk.
Claude Skills are folders containing specialized instructions and optional resources that Claude loads for relevant tasks. Each portable Skill centers on a SKILL.md file containing metadata and Markdown instructions. Organizations using Skills for repeated business processes should also define ownership and oversight through an appropriate AI governance framework.
Claude Code Skills are reusable workflows available in Claude Code. They can support coding, testing, debugging, documentation, and project procedures. After using Claude Code to build or modify an application, AGC’s vibe-coded website deployment guide explains how to prepare and verify it for production.
Useful options include Claude Code’s /code-review, /debug, /run, and /verify Skills, Anthropic’s PDF, Word, PowerPoint, and Excel Skills, the official skill-creator plugin, and focused custom Skills for research, writing, and organizational workflows. The best choice depends on the repeated task rather than the number of features.
Install a compatible plugin, place a personal Skill under ~/.claude/skills/<skill-name>/SKILL.md, or add a project Skill under .claude/skills/<skill-name>/SKILL.md. Confirm availability through /skills or the slash-command menu.
Personal Skills use ~/.claude/skills/<skill-name>/SKILL.md. Project Skills use .claude/skills/<skill-name>/SKILL.md. Plugin authors place Skills in the plugin’s skills/ directory, while Claude Code manages marketplace-installed copies through its plugin system.
Yes. Create a directory, add a SKILL.md file with a valid name and description, and write the workflow in Markdown. Scripts, references, and assets can support more complex tasks. Keep the Skill focused on one repeatable procedure and test its trigger behavior before wider use.
The Agent Skills format and many public examples can be accessed without purchasing an individual Skill. Product access and usage costs are separate. Anthropic currently supports Skills across multiple Claude plans, subject to capabilities, plan conditions, and organization settings.
Claude can automatically select an available Skill when its description matches the request. Users can also invoke many Skills directly. Important workflows should be tested because automatic selection depends on the description, context, configuration, and available Skills.
A Skill provides reusable procedural knowledge, instructions, scripts, and resources. MCP connects Claude to external tools, APIs, databases, and services. A Skill can explain how to use an MCP-connected tool, but it does not replace the connection or determine the external system’s permissions.
Community Skills should not be assumed safe. Review their instructions, scripts, dependencies, permissions, network behavior, and repository history. The risks become more serious when an AI tool has broad access to code, credentials, or external systems. See AGC’s guide to Shadow AI and cybersecurity for related organizational controls.
NIST
Learn how NIST Map and MAP 1-5 establish AI system context and help identify risks, benefits, components, limitations and potential...
Ai Governance
New to AI governance? Learn the skills, principles and frameworks to study first, then compare beginner training options and choose...
Learn how Claude Cowork, plugins and agentic workflows work for business, including practical use cases, security risks and responsible AI...