Skills

A skill is a folder with a SKILL.md file plus any supporting files. Invoke it with /skill-name, or Claude loads it automatically when its description matches your task. Skills follow progressive disclosure: descriptions load at session start; full content loads only when used.

Frontmatter controls invocability: disable-model-invocation: true for user-only workflows like /deploy (zero context cost until you invoke it); user-invocable: false hides it from the / menu while Claude can still use it.

---
description: Reviews code changes for security vulnerabilities, authentication gaps, and injection risks
disable-model-invocation: true
argument-hint: <branch-or-path>
---

## Diff to review

!`git diff $ARGUMENTS`

Audit the changes above for:

1. Injection vulnerabilities (SQL, XSS, command)
2. Authentication and authorization gaps
3. Hardcoded secrets or credentials

Use checklist.md in this skill directory for the full review checklist.

Report findings with severity ratings and remediation steps.

Three mechanics in that example: the !`...` line runs a shell command and injects its output into the prompt; $ARGUMENTS substitutes whatever you typed after the skill name ($0, $1 for positional access); and bundled files like checklist.md are readable because Claude sees the skill directory path.

Writing strong descriptions matters most — Claude matches your task against skill descriptions to decide which to load. Vague or overlapping descriptions mean the wrong skill loads, or none.

Check your understanding

Question 1What does disable-model-invocation: true do?

Question 2What does the !`git diff $ARGUMENTS` line in a SKILL.md do?

Question 3What determines whether Claude auto-invokes a skill?