Chapter 13: Encapsulating Knowledge with Agent Skills — From Conversations to Autonomous Procedures

This is Part 13 of a series walking through the book Master Claude Chat, Cowork and Code — From Prompting to Operational AI. In the previous chapter, we defined how Claude thinks through CLAUDE.md guardrails. Now we define what Claude can do. Chapter 13 introduces Skills — reusable, encapsulated procedures that transform Claude from a conversational tool into an operational agent.

The Distinction That Changes Everything

The book draws a sharp line between CLAUDE.md and Skills. CLAUDE.md defines how Claude should behave — prioritize security, include error handling, follow your coding conventions. Skills define what Claude should be able to do — deploy an application safely with automated rollback, generate a security audit report, rotate credentials following your organization's procedure.

A Skill contains the specific steps, decision points, and fallback procedures that a human has pre-approved. When you invoke a Skill, Claude executes the procedure following the pre-approved plan rather than making up a strategy on the fly. This distinction is what makes Skills safe enough for autonomous execution — the reasoning is Claude's, but the procedure is yours.

SKILL.md: Anatomy of a Reusable Procedure

Each Skill is a markdown file with YAML frontmatter that specifies metadata — what the Skill is for, when to invoke it, what inputs it requires, what outputs to expect — followed by the actual procedure instructions. The book walks through a complete, realistic Skill for generating security audit reports.

The YAML frontmatter for the security audit Skill includes: a name and trigger keyword, a description, typed inputs (repository URL, scope as "full" | "changes" | "critical", output format as "detailed" | "executive"), expected outputs (audit_report.md and findings.json), required context, and an approval level (manager approval required before running).

The procedure body then defines the exact steps: scope analysis with conditional logic based on input parameters, authentication and authorization analysis examining credential storage and session management, data handling analysis covering PII and encryption, dependency analysis checking for known vulnerabilities and outdated packages, and common vulnerability pattern scanning for SQL injection, XSS, CSRF, and input validation gaps.

I will not reproduce the full SKILL.md here, but the book's example is detailed enough to implement directly — including success criteria like "all code files in scope have been examined" and "report is generated within 15 minutes."

Trigger Descriptions: Making Skills Discoverable

One of the most practical sections in Chapter 13 covers trigger descriptions — the mechanism that allows Claude to automatically recognize when a Skill is relevant and offer to invoke it proactively.

The key insight is that good trigger descriptions anticipate the language people actually use, not formal command syntax. When a developer says "Can you review this code for security issues?", Claude should recognize the security-audit Skill and offer: "I have a comprehensive security audit procedure available. Would you like me to run it, or would you prefer a quick manual review?"

The book provides trigger examples for several Skills:

Deploy Application: "deploy", "release", "push to production", "go live", "need to get this to prod", "how do I ship this?"

Incident Response Runbook: "our database is down", "we're getting errors", "incident response", "what do we do now?", "system is down"

Skills at Multiple Levels of Sophistication

Chapter 13 makes clear that Skills exist on a spectrum. At the simplest end, a Skill is a structured prompt for a well-defined task: "analyze this code for security issues," "generate meeting notes from a transcript," "create a weekly status report." These are essentially pre-approved prompt templates that ensure consistency.

At the sophisticated end, Skills orchestrate complex workflows — calling APIs, interacting with external systems, making conditional decisions, generating multiple outputs, and validating results against success criteria. The security audit Skill is an example of this more complex end, with conditional scope analysis, multi-phase examination, and dual output formats.

The book encourages teams to start simple. A Skill that standardizes how your team generates API documentation is valuable even if it's just a well-structured prompt. Over time, you add sophistication — conditional logic, validation steps, structured outputs — as the procedure matures.

The Skills Library: Team-Wide Distribution

A single well-written Skill can multiply the productivity of an entire team — but only if it's discovered, trusted, and used consistently. The book introduces the Skills Library pattern: a shared, version-controlled repository of Skills organized by domain.

The recommended structure groups Skills by function: /skills/deployment/ for deploy, rollback, and status-check Skills; /skills/security/ for audit, credential rotation, and reporting; /skills/documentation/ for API docs and architecture diagrams; /skills/operations/ for incident response, backup, and monitoring.

Each Skill is a separate markdown file with complete documentation. The team maintains a README listing all available Skills with one-line descriptions. But the book emphasizes that the README isn't the primary discovery mechanism — Skills should be discoverable through natural language triggers or team onboarding.

What Chapter 13 Sets Up

With CLAUDE.md (Chapter 12) defining how Claude thinks and Skills (Chapter 13) defining what Claude can do, there's one remaining piece: connecting Claude to the external systems where your data actually lives.

Chapter 14: Connecting Systems with the Model Context Protocol (MCP) introduces the universal data bridge. MCP standardizes how Claude requests data, invokes tools, and interacts with external systems — Slack, Jira, GitHub, Google Drive, databases, and anything else you need. Write the connector once, use it everywhere. If CLAUDE.md is the constitution and Skills are the procedures, MCP is the nervous system that connects Claude to the outside world.