Guide for creating Claude Code skills following Anthropic's official best practices. Use when user wants to create a new skill, build a skill, write SKILL.md, update an existing skill, or needs skill creation guidelines. Provides structure, frontmatter fields, naming conventions, and new features like dynamic context injection and subagent execution.

Build AI agents with Pydantic AI (Python) and Claude SDK (Node.js)

Schema awareness - read before coding, type generation, prevent column errors

Progressive Web Apps - service workers, caching strategies, offline, Workbox

FastAPI with Supabase and SQLAlchemy/SQLModel

Mobile UI patterns - React Native, iOS/Android, touch targets

Web UI - glassmorphism, Tailwind, dark mode, accessibility

Stripe Checkout, subscriptions, webhooks, customer portal

WooCommerce REST API - products, orders, customers, webhooks

makepad-2.0-events

makepad-2.0-layout

makepad-2.0-troubleshooting

makepad-2.0-widgets

'Expert guidance on building Swift database client libraries. Use when developers mention: (1) building a database driver, (2) wire protocol implementation, (3) connection pooling design, (4) state machines for protocol handling, (5) NIO channel handlers for databases, (6) backpressure in result streaming, (7) actor executor alignment with NIO.'

'Expert guidance on Hummingbird 2 web framework. Use when developers mention: (1) Hummingbird, HB, or Hummingbird 2, (2) Swift web server or HTTP server, (3) server-side Swift routing or middleware, (4) building REST APIs in Swift, (5) RequestContext or ChildRequestContext, (6) HummingbirdAuth or authentication middleware, (7) HummingbirdWebSocket, (8) HummingbirdFluent or database integration, (9) ResponseGenerator or EditedResponse.'

Three.js shaders - GLSL, ShaderMaterial, uniforms, custom effects. Use when creating custom visual effects, modifying vertices, writing fragment shaders, or extending built-in materials.

>

>

Perform static and symbolic analysis of Solidity smart contracts using Slither and Mythril to detect reentrancy,

Parse NetFlow v9 and IPFIX records to detect volumetric anomalies, port scanning, data exfiltration, and C2 beaconing

Investigate USB device connection history from Windows registry, event logs, and setupapi logs to track removable

'Analyzes Windows Security, System, and Sysmon event logs in Splunk to detect authentication attacks, privilege

Build a vulnerability exception and risk acceptance tracking system with approval workflows, compensating controls

Systematically deobfuscate multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like

'This skill covers deploying anomaly detection systems for industrial control environments using machine learning

'Detects defense evasion techniques used by adversaries in endpoint logs including log tampering, timestomping,

'Detect lateral movement in network traffic using Zeek (formerly Bro) log analysis. Parses conn.log, smb_mapping.log,

'Detect abuse of legitimate Windows binaries (LOLBins) used for living off the land attacks. Monitors process

'Detects and analyzes malicious behavior in mobile applications through behavioral analysis, permission abuse

'Configures Fail2ban with custom filters and actions to detect port scanning activity, SSH brute force attempts,

'Detects early-stage ransomware indicators in network traffic before encryption begins, including initial access

Systematically remove malware, backdoors, and attacker persistence mechanisms from infected systems while ensuring

'Executes authorized attack simulations against Active Directory environments to identify misconfigurations,

Systematically hunt for adversary persistence mechanisms across Windows endpoints including registry, services,

Implement API abuse detection using token bucket, sliding window, and adaptive rate limiting algorithms to prevent

'Implements secure API key generation, storage, rotation, and revocation controls to protect API authentication

'Implements API rate limiting and throttling controls using token bucket, sliding window, and fixed window algorithms

Implement API Security Posture Management to continuously discover, classify, and score APIs based on risk while

Implement API threat protection using Google Apigee policies including JSON/XML threat protection, OAuth 2.0,

'Deploys DNS, HTTP, and AWS API key canary tokens across network infrastructure to detect unauthorized access

'Implementing Cloud Security Posture Management (CSPM) to continuously monitor multi-cloud environments for misconfigurations,

Reduce container attack surface by building application images on Google distroless base images that contain

Deploy and monitor Canary Tokens via the Thinkst Canary API for deception-based breach detection using web bug

'Implements full disk encryption using Microsoft BitLocker on Windows endpoints to protect data at rest from

SPF, DKIM, and DMARC form the three pillars of email authentication. Together they prevent domain spoofing, validate

'Implements FIDO2/WebAuthn hardware security key authentication including registration ceremonies, authentication

'Implements HashiCorp Vault dynamic secrets engines for database credentials, AWS IAM keys, and PKI certificates

'Deploys canary tokens and honeytokens (fake AWS credentials, DNS canaries, document beacons, database records)

'This skill covers implementing Gitleaks for detecting and preventing hardcoded secrets in git repositories.

Implement automated incident response playbooks in Cortex XSOAR to orchestrate security workflows across SOC