A complete guide to Claude Code's skill system — how skills work, which official ones to install first, how to spot dangerous community skills, and how to create your own in minutes.
This guide is reviewed for clarity, service accuracy, and AI-search readability. The next quarterly content review is tracked internally before unsupported metrics or client proof are added.
What Are Claude Code Skills?
Skills are like apps for your AI. Install one and Claude gains a new, repeatable capability. Under the hood, a skill is a SKILL.md file — a plain-text playbook with step-by-step instructions for a specific task. When you trigger it, Claude follows the playbook automatically.
Skills are plain text files, not code. Anyone can write one — which is both the most powerful thing about the system and its biggest security risk.
How to Install a Skill
Drop a folder containing a SKILL.md file into one of two locations:
bash~/.claude/skills/skill-name/ # works across all your projects .claude/skills/skill-name/ # works for the current project only
How to Use a Skill
Type /skill-name in Claude Code to trigger a skill explicitly. Or just describe what you want — Claude will automatically use the right skill if one matches.
Official Skills — Start Here
Built by Anthropic, ship with Claude Code, no installation needed:
/simplify— reviews recent code changes for quality and efficiency; spawns three review agents in parallel and auto-fixes problems/batch— makes large-scale changes across your entire codebase in parallel, breaking work into 5–30 isolated units/debug— troubleshoots your current Claude Code session by reading debug logs- Developer Platform skill — auto-activates when your code uses the Anthropic SDK
- Document creation skills —
docx,pdf,pptx,xlsx— create and edit files in each format
Community Skills — The Security Warning
The community skill ecosystem is large. SkillsMP alone hosts over 270,000 skills. A February 2026 security analysis of 3,984 community skills found:
- 36% contained prompt injection attacks
- 1,467 malicious payloads across the ecosystem
- 91% of malicious skills combined prompt injection with traditional malware
- 13% chance any randomly selected community skill has a critical security flaw
What a malicious skill can do
- Steal your API keys and passwords from environment variables
- Read and exfiltrate private files to an external server
- Run hidden shell commands on your computer
- Inject instructions that make Claude take actions you didn't authorize
How to stay safe
- Stick to official skills first — Anthropic's skills are verified safe and cover most workflows
- Only install from trusted sources — check GitHub stars, forks, and recent commit history
- Read the SKILL.md before installing — it's just text; look for anything that reads like a hidden instruction
- Never install from random links — verify the source yourself before running anything
- Check the
allowed-toolsfield — if a skill requestsBash(*)(unrestricted shell access), that's a red flag
How to Create Your Own Skill in 3 Steps
bash# Step 1: Create the folder mkdir -p ~/.claude/skills/my-skill-name # Step 2: Create the SKILL.md file with a name, description, and step-by-step instructions # Step 3: Run it — type /my-skill-name in Claude Code
Tips for writing good skills
- Write steps in sequence — Claude follows them top to bottom
- Use
$ARGUMENTSto accept dynamic input at runtime (a filename, URL, or topic) - Add
disable-model-invocation: trueif you only want the skill to fire when explicitly called - Include supporting files — templates, examples, reference data — in the same folder
Frequently Asked Questions
- How is a skill different from a CLAUDE.md file? CLAUDE.md sets persistent rules for all conversations in a project. A skill is a discrete, triggerable capability — like a function you can call rather than a configuration file.
- Can skills access the internet? Only if the skill instructs Claude to use a tool with internet access (web search, fetch). Skills themselves are just text; the permissions depend on what tools your session has available.
- How do I share a skill with my team? Put the skill folder in your project's
.claude/skills/directory and commit it to git. Everyone who clones the repo gets the skill automatically.