Claude Code skills

Reproducible practice

Build a read-only skill and test its discovery boundary

Package a repeated repository-status procedure with explicit invocation and least-privilege tools.

Prerequisites

• A unique temporary repository.
• A procedure that is repeated and longer than a durable fact.
• No untrusted command substitution or secret-bearing fixture.

Steps

1. Create the skill fixture

   Use project scope and disable automatic model invocation while evaluating it.

   SKILL_LAB=$(mktemp -d "${TMPDIR:-/tmp}/claude-skill.XXXXXX")
   printf '%s\n' "$SKILL_LAB"
   cd "$SKILL_LAB" && git init -q
   mkdir -p .claude/skills/status-audit
   printf '%s\n' '---' 'description: Summarize repository status without editing.' 'disable-model-invocation: true' 'allowed-tools: Bash(git status --short)' '---' '' 'Run git status --short and report only observed changes.' > .claude/skills/status-audit/SKILL.md

2. Check static structure

   Confirm frontmatter, filename, and command name before starting Claude.

   sed -n '1,12p' .claude/skills/status-audit/SKILL.md
   git status --short

3. Inspect discovery

   Open `/help` and confirm `/status-audit`; optional interactive behavior was not tested in this audit.

4. Test both invocation paths

   Invoke explicitly first. Enable model invocation only after a natural-language prompt selects the skill reliably and safely.

Expected result

The skill is discoverable by its directory name, can be invoked explicitly, and has no edit tool or automatic invocation during evaluation.

Validation

• Confirm the allowed tool exactly matches the command used.
• Compare `git status --short` before and after invocation.
• Test non-matching prompts to detect over-triggering before enabling model invocation.

Failure handling

Cleanup or rollback

• Return to the original directory and remove only the printed SKILL_LAB path.
• Remove a project skill through a reviewed commit; do not delete personal skills broadly.

Boundaries and when not to use it

• Dynamic context commands execute before Claude sees the skill; treat them as code and review inputs.
• Allowed tools reduce exposure but do not make untrusted instructions safe by themselves.