Claude Code Skills: Create, Install and Use Them Safely

Do you keep pasting the same checklist into the chat? A skill does that once and for all. Claude Code skills are folders with a SKILL.md file that holds instructions for recurring tasks. Claude loads them on its own when your request fits, or you call them with /name. Below you will see how to create, install, delimit and vet skills.

All details come from the official Claude Code and platform documentation (sources below), as of October 2026.

What are Claude Code skills and how does Claude load them?

A skill is a SKILL.md file with instructions. It pays off when you keep pasting the same checklist or workflow into the chat. Skills follow the open "Agent Skills" standard. Claude Code extends it with features such as invocation control and running in a subagent.

What matters is the loading principle that the documentation calls "Progressive Disclosure":

• Always in context: the name and description of every skill, so Claude knows what is available.
• When needed: the full content, as soon as you type /name or Claude finds a skill that fits the request.
• Only on access: bundled files, such as references or scripts. A script is executed, and only its output takes up context, not its code.

The description costs about 100 tokens per skill, and the main body of SKILL.md stays under 5,000 tokens. Details therefore belong in extra files rather than in SKILL.md. That way they cost almost nothing until Claude needs them.

Where do skills live and how do I install them?

For your own skills, a folder is enough. The documentation names these locations:

• ~/.claude/skills/<name>/SKILL.md: personal, for all your projects.
• .claude/skills/<name>/SKILL.md: in the project. If you commit the folder, your team has it too.
• <plugin>/skills/<name>/SKILL.md: skills from plugins, callable as /plugin-name:skill-name.
• Enterprise: skills in an organization's managed settings directory. They apply to all users on machines where the organization rolls them out.

If names clash, the order is: enterprise before personal, personal before project. Plugin skills are namespaced and do not collide.

"Installing" third-party skills usually means: add a plugin marketplace and pick a plugin. The official anthropics/skills repository describes this route:

/plugin marketplace add anthropics/skills
/plugin install document-skills@anthropic-agent-skills
/plugin install example-skills@anthropic-agent-skills

Alternatively, open /plugin and choose "Browse and install plugins". A plugin bundles skills, subagents, hooks and MCP servers into one unit. You do not need to package a single skill this way: a folder with SKILL.md is enough.

Skill, CLAUDE.md, slash command, subagent or MCP: what fits when?

These features solve different problems and complement each other. The table summarizes the official "Extend Claude Code" overview and the skills page.

The rule of thumb: what Claude should always know belongs in CLAUDE.md, and that should stay under 200 lines. What is only needed sometimes, or is a workflow, belongs in a skill. When CLAUDE.md grows into a procedure, it is time for a skill.

MCP and skills do not compete. MCP supplies the tools, and a skill explains how to use them sensibly, for example with the schema and query patterns. If something must happen every single time, hooks are the tool. A rule in a skill is a request, not a guarantee.

How do I create my own skill in 5 minutes?

1. Create the folder: mkdir -p ~/.claude/skills/commit-nachricht.
2. Create the file SKILL.md inside it. The metadata sits between two --- lines at the very top of the file.
3. Write in description what the skill does and when it should apply, ideally in the third person. Optionally, when_to_use adds further triggers such as typical phrasings. The text is appended to the description.
4. Write the instructions below it and move references into separate files.
5. Test with /commit-nachricht or with a matching question.

---
name: commit-nachricht
description: Schreibt eine Commit-Nachricht aus den vorgemerkten Änderungen. Zu verwenden, wenn nach einer Commit-Nachricht gefragt wird.
---

## Vorgemerkte Änderungen

!`git diff --staged`

## Anweisungen

Fasse die Änderungen oben in einer Betreffzeile und zwei bis drei Stichpunkten zusammen.
Nenne Risiken wie fehlende Fehlerbehandlung. Ist der Diff leer, sage das.

The line with the exclamation mark runs the command before Claude sees the text. Its output replaces the placeholder. The name may be at most 64 characters, lowercase letters, numbers and hyphens only. The description is limited to 1,024 characters, and SKILL.md should stay under 500 lines. Claude Code watches the skill directories, and changes apply within the session. You will find a detailed guide in our guide to skills.

Which Claude Code skills are worth it, and where do I find them on GitHub?

The official source is the repository github.com/anthropics/skills. It contains examples from four areas: creative and design, development and technical (such as web app testing and MCP server generation), enterprise and communication, and document skills for docx, pdf, pptx and xlsx. A template/ folder provides a template.

Two notes from the repository: many skills are under Apache 2.0, but the four document skills are source-available only, not open source. And according to the provider, the skills are meant "for demonstration and educational purposes". Test them thoroughly before relying on them for critical tasks.

There is no general "best claude code skills" ranking. What makes sense is whatever covers your recurring tasks: review checklists, release workflows, schema and API knowledge. The skills database of our community offers a collection from practice. There is also Code Guardian, an add-on package with skills and verification rules for Claude Code.

How safe are third-party skills?

A skill is software that Claude is allowed to follow. Anthropic recommends using skills only from trusted sources, meaning ones you wrote yourself or that come from Anthropic. A malicious skill can make Claude use tools or code differently from what its stated purpose suggests. Possible consequences are data exfiltration or unauthorized access.

Check before use:

• Read all files: SKILL.md, scripts and resources. Watch for unexpected network or file access.
• Distrust external fetches: loaded content can contain instructions, and dependencies can change later.
• Check allowed-tools: the permissions of a project skill also apply in untrusted folders.
• Treat plugins separately: they can contain hooks and MCP servers that run code with your user permissions. /plugin shows what a plugin brings before installation.
• Consider auto-updates: the plugin you vetted can change in the background.

Two settings help here. The option disableSkillShellExecution replaces embedded shell commands in skills with a placeholder. It is most useful in an organization's managed settings. With skillOverrides in the settings, you set a third-party skill to "on", "name-only", "user-invocable-only" or "off" without changing its file.

Frequently asked questions

Can I call a skill by hand only?

Yes. With disable-model-invocation: true, Claude does not load the skill on its own, and its description stays out of the context. You then start it with /name. The documentation recommends this for skills with side effects, such as deployments.

Do I need a plugin to use skills?

No. A skill in ~/.claude/skills/ works on its own. A plugin pays off when you want to distribute several skills, subagents, hooks or MCP servers as one unit, for example across several repositories.

How much context do many skills cost?

Permanently only the name and description, about 100 tokens per skill. Vague or overlapping descriptions can cause Claude to load the wrong skill. So state concretely what the skill does and when it applies.

Are there length limits?

SKILL.md should stay under 500 lines. The name is limited to 64 characters, the description to 1,024. In addition, Claude Code truncates the description and when_to_use together at 1,536 characters in the skill directory.

Do I have to restart Claude Code after changes?

Usually not. Claude Code picks up new, changed or removed skills within the session. If you create a completely new skills/ directory in the middle of a session, run /reload-skills.

How do I share skills in a team?

Put them under .claude/skills/ in the project and commit them. For several repositories, a plugin is a good fit. Skills from claude.ai and the API do not sync with Claude Code. You can find help with team setup under AI development.

Sources

• Claude Code documentation: Extending Claude Code with Skills
• Claude Code documentation: Extend Claude Code (feature comparison)
• Claude Code documentation: Plugins overview
• Claude Code documentation: Plugin security and trust
• Anthropic: Agent Skills Overview
• Anthropic: Skill authoring best practices
• GitHub: anthropics/skills (official repository)

As of: October 2026. General information; Claude Code features change frequently.