Skills: Model-Invoked Automation

Your request
    ↓
Claude analyzes context
    ↓
Claude reads available skill descriptions
    ↓
If a skill matches → Claude activates it automatically
    ↓
The skill enriches Claude's instructions

> Extract data from the report.pdf file

[Claude detects "PDF" + "extract" → automatically activates pdf-expert]

~/.claude/skills/
├── pdf-expert/
│   └── SKILL.md
└── api-tester/
    └── SKILL.md

.claude/skills/
├── deployment/
│   └── SKILL.md
└── migration/
    └── SKILL.md

my-skill/
└── SKILL.md

my-skill/
├── SKILL.md           # Instructions (required)
├── reference.md       # Additional documentation
├── scripts/
│   └── helper.py      # Utility scripts
└── templates/
    └── template.txt   # Templates to use

### Skill: API Tester

```markdown
---
name: api-tester
description: Test and debug REST APIs. Use when user wants to test
             endpoints, verify API responses, or debug HTTP
             request problems.
allowed-tools: Read, Bash
---

# API Tester

## Capabilities
- Endpoint testing with curl
- JSON response validation
- Response time measurement
- Authentication testing

## Methodology
1. Identify endpoint to test
2. Build appropriate curl request
3. Analyze response (status, body, headers)
4. Propose fixes if error

## Curl Templates

### GET with auth
```bash
curl -X GET "URL" \
  -H "Authorization: Bearer TOKEN" \
  -H "Content-Type: application/json"

### Skill: Migration Helper

```markdown
---
name: migration-helper
description: Help create and manage database migrations.
             Use when user talks about migrations, schemas,
             or database structure changes.
allowed-tools: Read, Write, Bash(npx prisma:*)
---

# Migration Helper

## Supported Framework
Prisma (detected via prisma/schema.prisma)

## Migration Process
1. Analyze requested change
2. Propose schema modifications
3. Generate migration with `prisma migrate dev`
4. Verify migration is correct

## Best Practices
- Always name migrations descriptively
- Check existing data before destructive migration
- Test on local DB copy first

## Prisma Commands
```bash
# Create migration
npx prisma migrate dev --name description

# See status
npx prisma migrate status

# Reset (caution!)
npx prisma migrate reset

### Skill: Security Scanner

```markdown
---
name: security-scanner
description: Scan code for security vulnerabilities.
             Use when user asks for security audit,
             looks for flaws, or wants to secure code.
allowed-tools: Read, Grep, Glob
---

# Security Scanner

## Vulnerabilities Searched

### Injection
- SQL Injection
- NoSQL Injection
- Command Injection
- LDAP Injection

### XSS
- Reflected XSS
- Stored XSS
- DOM-based XSS

### Auth/Session
- Broken Authentication
- Session Fixation
- Insecure Direct Object Reference

### Other
- Sensitive Data Exposure
- Security Misconfiguration
- Insecure Deserialization

## Patterns to Search

```javascript
// SQL Injection
`SELECT * FROM users WHERE id = ${userId}`  // ❌ Dangerous
`SELECT * FROM users WHERE id = ?`          // ✅ Parameterized

// XSS
element.innerHTML = userInput;              // ❌ Dangerous
element.textContent = userInput;            // ✅ Safe

// Command Injection
exec(`ls ${userPath}`);                     // ❌ Dangerous
execFile('ls', [userPath]);                 // ✅ Safer

my-skill/
├── SKILL.md
└── reference.md    # Additional documentation

my-skill/
├── SKILL.md
└── scripts/
    └── analyze.py