Stop re-explaining your triage runbook and OWASP checklist to Claude every single time. Package it once as a Skill and it fires only when the request actually matches.
See the workflow in action, tap through the tabs below:
$ scaffold a personal skill
mkdir -p ~/.claude/skills/incident-triage cd ~/.claude/skills/incident-triage touch SKILL.md
$ prompt an incident-triage skill would handle
Given this alert payload, classify severity per our runbook, identify the likely blast radius, and draft the first Slack update for #incidents. Do not page secondary on-call unless severity is SEV1.
$ prompt a code-review skill would handle
Review this diff for OWASP Top 10 issues, missing input validation, and any new dependency added without a version pin. Summarize findings as inline PR comments, not a wall of text.
Only install skills you trust. Skills can bundle executable scripts, so a malicious one can direct Claude to run code that doesn’t match its stated purpose. Only use skills you wrote yourself or got directly from Anthropic, and read every script before enabling a third-party one.
Surfaces don’t sync. A skill built for Claude Code has to be zipped and re-uploaded separately to show up in Claude.ai or Cowork, they don’t share a filesystem.
What Claude Skills Actually Are
A Skill is a folder. That's it at the core: one required file called SKILL.md with a short YAML header (a name and a description) followed by plain-language instructions, plus optional helper files like scripts and reference docs sitting next to it. You write it once, drop it somewhere Claude can see it, and from then on Claude reads your name and description at the start of every session, silently decides "does this request match," and only pulls in the full instructions when it actually needs them.
That last part is the whole trick, and Anthropic calls it progressive disclosure. Only the name and description sit in context all the time, and that costs next to nothing, roughly 100 tokens per skill. The full SKILL.md body loads only when a task triggers it. Bundled scripts run through bash, and only their output enters the conversation, never their source code. You can have twenty skills installed and pay for maybe two of them on any given task, the ones that actually fired.
If you have ever pasted the same "review this Terraform plan for security issues" or "walk me through triaging a P1 alert" prompt into Claude for the third time this month, that's your signal. Stop pasting. Write a Skill.
Quick Setup
Where you build a Skill depends on where you live day to day.
Claude Code
No upload step, no dashboard. Make a folder and write the file.
mkdir -p ~/.claude/skills/incident-triage cd ~/.claude/skills/incident-triage touch SKILL.md
Put it in ~/.claude/skills/ for a personal skill available in every project, or .claude/skills/ inside a repo if it should only fire on that codebase. Claude Code discovers and hot-reloads it automatically, no restart needed.
Claude.ai and Cowork
Go to Settings, then Customize, then Skills, and upload a ZIP where the skill folder is the single top-level entry, folder name matching the name field exactly. You'll need "Code execution and file creation" turned on first. Cowork sessions pull whatever skills are enabled on your claude.ai account at session start, they do not read your local filesystem the way Claude Code does, so a skill you built for the CLI has to be packaged and re-uploaded separately to show up in Cowork.
If you're on Mac and on a Pro, Max, or Team plan, there's a faster path in Cowork: click the plus icon in the composer and hit "Record a skill." Do the task once on screen with narration, click done, and Claude drafts the SKILL.md from watching you work. You still review and edit it before saving, but it beats writing the instructions from scratch.
The Mindset: Stop Hoarding Prompts, Start Writing Descriptions
The single highest-leverage sentence in any Skill is the description field, because it's the only thing (besides the name) that decides whether Claude ever calls the skill at all. A vague description like "helps with infrastructure stuff" will sit there dormant or, worse, fire on the wrong requests. A description like "Reviews Terraform and CloudFormation plans against a security baseline before apply, checking for public S3 buckets, open security groups, and missing encryption. Not for general IaC authoring" gives Claude the verbs, the triggers, and the boundary in one shot.
Treat the SKILL.md body the way you'd treat onboarding docs for a new hire on your team: assume competence, skip the basics, write the specific decision points and edge cases that actually trip people up. Keep the main file lean, target under 5,000 tokens, and push anything long (a full compliance matrix, a giant reference table) into a separate markdown file that Claude only opens if the task calls for it.
7 Workflows Worth Turning Into Skills
1. Incident triage runbook
Feed Claude your actual escalation logic instead of re-explaining it every time PagerDuty fires.
Given this alert payload, classify severity per our runbook, identify the likely blast radius, and draft the first Slack update for #incidents. Do not page secondary on-call unless severity is SEV1.
2. Postmortem drafting
A skill that knows your team's postmortem template turns three hours of blank-page dread into a first draft in minutes: "Pull the incident timeline from these Slack exports and logs, fill out our five-whys template, and flag any action item that lacks an owner."
3. Infrastructure-as-code security review
Encode your baseline once. No public buckets, no 0.0.0.0/0 ingress on anything but the load balancer, no hardcoded secrets, and every skill invocation checks the same list instead of whatever the reviewer remembered that day.
4. Log analysis triage
Point a skill at your log format and common failure signatures so "why did checkout latency spike at 2am" gets a structured answer instead of a generic "check your logs" non-answer.
5. Compliance evidence collection
SOC 2 and ISO 27001 audits eat weeks chasing screenshots and access logs. A skill that knows exactly which artifact satisfies which control turns evidence gathering into "run this, attach the output."
6. Code review with a security lens
Review this diff for OWASP Top 10 issues, missing input validation, and any new dependency added without a version pin. Summarize findings as inline PR comments, not a wall of text.
7. Bootstrap new skills with skill-creator
Anthropic ships a meta-skill called skill-creator in the public anthropics/skills repo. It interviews you about the task, suggests a tighter description when yours is too vague to trigger reliably, and formats the instructions correctly. Use it for your first few skills before you're writing them from muscle memory.
Safety and Gotchas
Skills can bundle executable code, and that's exactly where the risk lives. Anthropic's own guidance is blunt: only install skills you wrote yourself or got directly from Anthropic. A malicious skill can direct Claude to run code or call tools in ways that don't match what the description promised, and a skill that fetches external URLs can pull in prompt injection from whatever page it loads, even if the skill looked clean at install time. Treat a third-party skill like software from a stranger: read the SKILL.md, read every script, check for network calls or file access you didn't expect.
A few limits worth knowing before you hit them. The name field caps at 64 characters, lowercase letters, numbers, and hyphens only, no "claude" or "anthropic." The description caps at 1,024 characters on claude.ai and the API. Total skill size stays under 30MB uncompressed on the API. Skill data is not covered under Zero Data Retention arrangements, it follows Anthropic's standard retention policy instead.
One more distinction worth being precise about, because people conflate it constantly: MCP connectors give Claude access to a tool or data source, Skills teach Claude what to do once it has that access. They're not competing features, they're meant to stack. An MCP connector gets Claude into your ticketing system; a skill tells it exactly how your team triages tickets once it's there.
Usage and Cost Tips
There's no separate line-item fee for skills themselves. You pay standard token usage on whatever context loads, plus, on the API, the code execution tool that skills run through. Anthropic gives every org 1,550 free container-hours a month, then bills $0.05 per container-hour beyond that, with a five-minute minimum per invocation. If you're calling skills constantly in an automated pipeline, that minimum adds up fast, batch related tasks into fewer invocations where you can.
On claude.ai and in Cowork, custom skills you upload are private to you unless your org is on Team or Enterprise, where they can be shared workspace-wide or centrally provisioned by an admin. On the API, uploaded skills are automatically shared across the whole workspace, not per-user, so coordinate before someone overwrites the compliance-checklist skill everyone depends on.
If you have not set up the assistant itself yet, start with our Claude Code tutorial or the Claude in Chrome workflow guide, then come back and layer skills on top. Want structured, hands-on practice instead of another blog post? Check our courses.
FAQ
Do Skills work the same way in Claude Code and Claude.ai?
The core SKILL.md format is shared, but the surfaces don't sync automatically and Claude Code supports extra frontmatter fields (like allowed-tools and hooks) that will hard-error if you try to upload that same file to claude.ai or the API. Package separately for each surface.
Can a Skill replace an MCP connector?
No. A Skill has no way to reach outside systems on its own, it only teaches Claude a process. If the task needs live data from Jira, Datadog, or your database, you still need the connector; the Skill just makes sure Claude uses it consistently.
What's the fastest way to know if my Skill's description is too vague?
Test it against three request types: a normal in-scope ask, an edge case, and something clearly out of scope. If the skill fires on the out-of-scope test or stays dormant on the normal one, tighten the description before you touch the instructions.
Get Building
Start with one skill. Pick the prompt you've retyped the most this month, whether that's incident triage, a Terraform review checklist, or a postmortem template, and turn it into a SKILL.md this afternoon. Test it against the three scenarios above, fix the description until it triggers reliably, then move to the next one. That's the whole loop, and it compounds fast once your team is sharing the same playbooks instead of everyone re-explaining their process to Claude from scratch every time.
