Skills (Claude Code)
Claude CodeDefinition
Reusable markdown instruction files with YAML frontmatter that define custom slash commands in Claude Code. Invoked with /skill-name. Frontmatter configures: description (for trigger matching), allowed-tools (tool restrictions), and context (fork for isolation). Stored in .claude/skills/.
Example Usage
Create a /security-review skill that runs in a forked context with read-only tools, providing consistent security auditing on demand.
In Depth
Skills are Claude Code's reusable command system. A skill is a folder containing a SKILL.md file — a markdown document with YAML frontmatter — stored in .claude/skills/. Once defined, a skill becomes a slash command: type /skill-name in Claude Code to invoke it.
Why skills exist:
Without skills, every session requires you to explain recurring workflows from scratch: "review this code for security issues using the following checklist…" Skills package that instruction set permanently. A /security-review skill can encode your full security checklist, the expected output format, and which tools are permitted — reproducible every time.
Anatomy of a skill:
The SKILL.md file has two parts:
- YAML frontmatter (between
---delimiters) — machine-readable config for how the skill is triggered and executed. - Markdown body — the natural-language instructions Claude follows when the skill is invoked.
Frontmatter fields include:
description— natural language trigger phrase; Claude uses this for automatic activation when the user's request matches.allowed-tools— whitelist of tools this skill may use (principle of least privilege).context—forkto run in an isolated, discarded context;currentto use the live session context.
Progressive disclosure: skills support layered instruction design. The SKILL.md body can start with a brief summary and expand into detailed steps, letting Claude adapt its response depth to the complexity of the invocation.
Context fork: when context: fork is set, the skill runs in a completely isolated context window. Changes it makes to the session state are discarded when it exits. This is ideal for read-only analysis tasks (security audits, code reviews) where you don't want the skill's exploration to pollute the main session.
See also: Skill Frontmatter, context: fork, CLAUDE.md.
Related concept: Custom Skills & Slash Commands.
How It Compares
| Feature | Skills | CLAUDE.md |
|---|---|---|
| Purpose | Reusable, invocable workflows | Persistent ambient context |
| Invocation | /skill-name or auto-triggered | Loaded automatically at session start |
| Isolation option | context: fork (discards after) | No isolation — always active |
| Tool restriction | allowed-tools frontmatter | Not applicable |
| Storage location | .claude/skills/<name>/SKILL.md | Project root or ~/.claude/ |
| Version controlled | Yes | Yes |
How It's Tested & Common Confusions
CCA-F questions on skills typically cover:
1. Invocation mechanics — how a skill is triggered (slash command /skill-name or automatic via description match). Know that both explicit and automatic activation exist.
2. Frontmatter fields — scenario questions ask which frontmatter key controls a given behavior: tool restriction → allowed-tools; isolation → context: fork; auto-trigger → description.
3. Skills vs. CLAUDE.md — skills are invocable commands for specific workflows; CLAUDE.md provides ambient context for every session. The exam tests whether you know which to reach for: persistent project context → CLAUDE.md; reusable task workflow → skill.
Frequently Asked Questions
What happens when context: fork is set on a skill?
The skill runs in an entirely separate context window. It cannot read the current session's conversation history, and any changes it makes — files read, plans formed — are not visible to the main session after it exits. This makes forked skills safe for exploratory tasks that shouldn't pollute the working context.
How does automatic skill activation work?
When the `description` frontmatter field contains a natural-language trigger phrase (e.g., 'when asked to review code for security vulnerabilities'), Claude Code monitors user messages and automatically invokes the skill when the request semantically matches. You don't have to type the slash command explicitly.