Claude Skills: build, deploy and secure your skills in 2026

A Claude Skill is a method sheet that Claude applies on its own at the right moment. You describe a task from your work once, with its steps and rules, and Claude follows it whenever the situation comes up.

This guide, updated on October 12, 2026, shows how to create one in claude.ai, how to roll it out across an organization and how to secure it. The strategic question, why your methods should become an asset the company owns, is covered in turning business expertise into AI skills.

The essentials in six points

• You use claude.ai: go straight to the step-by-step guide. It requires no technical skills.
• A skill is a folder with a SKILL.md file. Claude triggers it on its own when the description matches your request, or you ask for it explicitly.
• It works in claude.ai, Cowork and Anthropic’s technical tools, but a skill created in one place does not automatically appear elsewhere.
• Yes, on Team and Enterprise, an administrator can provision a skill for the whole organization, enabled by default for everyone.
• A skill can make Claude run code. Anthropic warns that a malicious skill can exfiltrate data, and August 2026 research shows a poisoned skill can pass testing without giving itself away.
• The format has been an open standard since December 18, 2025, read by Codex, Cursor, GitHub Copilot and VS Code.

What is a Claude Skill

A skill is a folder. At minimum it contains a SKILL.md file: a header with two required fields, name and description, followed by instructions written in plain text. It can also bundle reference files, templates and scripts.

The description is the sentence that tells Claude when to use the skill. The rest of the file describes the method to follow.

Create your first skill in claude.ai, step by step

This path in claude.ai requires no technical skills: you describe, Claude writes. It follows Anthropic’s Help Center articles on using skills and creating a custom skill, read on October 12, 2026.

1. Turn the feature on. In Settings > Capabilities, check that “Code execution and file creation” is enabled: skills depend on it. On Team and Enterprise, the account owner must first enable that option and Skills in Organization settings > Plugins & skills.
2. Ask Claude to write the skill. Open a conversation and describe the task in your own words: “I want to create a skill that checks the cases cited in my draft briefs.” Attach a good example and your house rules. Claude asks questions, then relies on an internal Anthropic skill, skill-creator, to produce a well-structured folder.
3. Save the archive. Claude delivers the skill as a file to save. The Help Center specifies that the .zip archive must contain the skill folder at its root, and that the folder must carry the skill’s name. Claude takes care of that: keep the archive as it is, without unzipping or editing it.
4. Upload it in settings. In Customize > Skills, click ”+”, then “Create skill” and “Upload a skill”, and select the .zip archive exactly as Claude delivered it.
5. Test it with a real request. Open a new conversation and phrase a request the way you would on an ordinary day. If the skill triggers, Claude shows that it is using it: “Using” followed by the skill’s name appears in the steps of its thinking, before its answer. If it stays silent, ask Claude to rework the description.

Our Claude Cowork training takes each participant through these steps, on their own tasks.

How a skill works

The name is at most 64 characters of lowercase letters, digits and hyphens, and matches the folder name. The description can run to 1,024 characters, and it determines whether the skill triggers. According to Anthropic’s platform documentation, Claude matches your request against this description to decide whether to trigger the skill. It must say what the skill does and when to use it.

Two ways to trigger a skill

• Automatic: Claude recognizes a request that matches the description and loads the skill without you naming it.
• Explicit: on claude.ai, you simply ask Claude, in plain language, to use a given skill. In Claude Code, the developer tool, you type /skill-name; there, the disable-model-invocation: true field restricts a skill to explicit calls, which suits actions with consequences, such as a production release.

Progressive disclosure

Claude works within a limited context, the amount of text it keeps in view during a conversation, measured in tokens (fragments of words). A skill does not load into it all at once. Anthropic’s documentation describes three levels.

Level	When it loads	Context cost
Name and description	Always, at startup	About 100 tokens per skill
Body of SKILL.md	When the skill triggers	Under 5,000 tokens
Files and scripts	On demand	Nothing until read; a script returns only its output

This design lets you install many skills without flooding the context. It has a limit, which Anthropic’s enterprise guide spells out: every description competes with the others, and too many active skills degrade Claude’s ability to pick the right one.

Where skills run

If you only use claude.ai, you can skip this table: it mostly serves technical teams. Cowork is the desktop application where Claude works on your files and office documents.

Surface	How a custom skill gets there	What to know
claude.ai and Cowork	.zip upload in settings, or provisioning by an administrator	Code execution required; network access depends on settings
Claude Code	Folder on disk	Full network access of the machine
Claude API	/v1/skills endpoints, with the code execution tool	Isolated container, no network access, no package installation; shared across the workspace
Agent SDK	Folders read from disk, according to the settingSources setting	The Skill tool must be allowed in the session
Claude Platform on AWS, Microsoft Foundry	Skills API	Same rules as the API; Foundry requires a “Hosted on Anthropic” deployment

One line of the documentation sums up the main constraint: “Custom Skills do not sync across surfaces.” A skill uploaded to claude.ai does not exist for the API, and vice versa; Claude Code skills live on disk, separate from both.

Two exceptions soften the rule. Claude Code downloads the skills from your claude.ai account into ~/.claude/skills/synced/ when you sign in with that account, according to its documentation. And skills provisioned by an administrator load in chat, in Cowork and in Claude Code.

The practical consequence: every skill’s source lives in a Git repository, the tool that keeps the history of every version of a file, and each surface is fed from there. Anthropic’s enterprise guide recommends exactly that, with Git as the single source of truth.

Three families of skills

• Skills provided by Anthropic. Word (docx), Excel (xlsx), PowerPoint (pptx) and PDF are active with no setup on claude.ai and callable through the API. Domain libraries come on top: six finance skills, including comparable company analysis and DCF models, announced with Claude for Financial Services, and lesson planning skills built into Claude for Teachers.
• In-house skills. The ones you write. They encode your methods, criteria and formats, which no generic skill knows.
• Third-party skills. The partner skills directory opened on December 18, 2025, according to Anthropic’s post updated that day, plus open source repositories and plugin marketplaces. This family is the most convenient and the one that demands the most scrutiny.

A first business skill

The best first skill addresses a task that is repeated, checkable and demands close attention. The example below is drawn from a training session delivered at a corporate law firm, anonymized: checking the case law cited in a draft brief before it goes out. In the AI agents training, each participant configures an agent for their own tasks in this way.

You do not have to write this file yourself: in claude.ai, Claude writes it, as the step-by-step guide shows. It is shown here so you can see what it contains.

The skill’s folder carries the same name as its name field:

cited-case-check/
├── SKILL.md
└── references/
    └── citation-rules.md

And here is its SKILL.md file:

---
name: cited-case-check
description: Checks every court decision cited in a draft brief or memo
  (court, date, docket number, holding). Use when a lawyer asks to
  review, verify or source the case law in a draft.
---

# Cited case check

## Read first
references/citation-rules.md (the firm's citation format).

## Steps
1. List every decision cited and the sentence that relies on it.
2. Check court, date and number in the database the firm has approved.
   Never complete a reference from memory.
3. Compare the holding claimed in the draft with the decision itself.
4. Return a table: reference, status (verified, not found, inaccurate,
   holding questionable), source consulted, comment.

## Out of scope
- Do not rewrite the argument.
- Do not add case law unless the lawyer asks.
- Flag a decision that cannot be found instead of correcting it.

Three choices make this skill reliable.

• The description uses the lawyers’ own verbs: review, verify, source. That is what makes it trigger at the right moment, and only then.
• The out-of-scope section is written down. It stops the agent from “fixing” a reference it cannot find, which is precisely the error to avoid.
• The output is a status table that a lawyer scans in a minute instead of rereading the whole draft.

The skill does not decide access to legal databases: that belongs to connectors and permissions configured separately.

Before rolling it out, test it on real drafts that contain known errors. Anthropic’s enterprise guide asks for three to five representative queries per skill, covering cases where it should trigger, cases where it should not, and ambiguous ones, on each model you use.

Deploying a skill across the organization

Yes, on Team and Enterprise, an administrator can provision a skill for the whole organization. Provisioning means installing it on users’ accounts automatically, with nothing for them to do.

What Team and Enterprise allow

The Help Center describes the path: in the organization settings, under Plugins & skills, an administrator uploads an archive or writes the skill directly. It is provisioned to all users immediately.

• Enabled by default for everyone, it can be turned off individually but not removed by the user.
• It loads everywhere: chat on the web and in Claude Desktop, Cowork, and Claude Code for signed-in users.
• Users can publish their own skills to the organization library. On Team, publishing is open by default, with no review. On Enterprise, it has defaulted to owner approval since October 2, 2026, if no setting was chosen.

Capability	Team	Enterprise
Provisioning to the whole organization	Yes	Yes
Provisioning to a single group, through a plugin	No	Yes
Security scanning of skills	No	Yes
Publishing by users, default setting	Open	Requires review

A clarification is needed for readers who come across the opposite claim. As of October 12, 2026, Anthropic’s platform page still states that claude.ai supports neither centralized management nor organization-wide distribution of skills. The Help Center, checked the same day, describes provisioning screen by screen: this guide follows it.

The seven locations in Claude Code

Location	Path	Scope
Enterprise managed	Managed settings directory	Every machine where the organization deploys it
Personal	~/.claude/skills/	All your projects on the machine
Project	.claude/skills/	The repository, shared by commit
Nested	<subdir>/.claude/skills/	Loaded once Claude works on files in that subfolder
Additional directory	.claude/skills/ in a folder added with --add-dir	The current session
Plugin	<plugin>/skills/	Wherever the plugin is enabled, called as /plugin:skill
claude.ai account	~/.claude/skills/synced/	The skills from your account, synced

The context: fork field runs a skill in a subagent, a separate instance of Claude that works on its own and hands back its result. That subagent does not see the conversation history and receives only the skill’s content. It suits long tasks, such as document research, that should not clutter the main session.

Plugins and marketplaces

A plugin packages several skills with other settings, and a marketplace distributes a catalog of them. It is the right way to ship a function’s complete toolkit, and it is also how most third-party skills arrive.

Governance: who writes, who reviews, who retires

A skill should be governed like code: written, reviewed, versioned and distributed with the rigor of software, because it can make Claude act on your files and tools.

Anthropic’s enterprise guide sets rules borrowed from software engineering. A skill’s author should not be its reviewer. Every skill sits in an internal registry with its purpose, owner, version, dependencies and the date of its last evaluation.

In production, the version is pinned. On the API, a request that omits it uses the latest one: any workspace member who uploads a new version instantly changes what your agents do. The guide also recommends checksums and signed commits to guarantee provenance.

Retirement is the decision most often forgotten. A skill whose evaluations keep failing, or whose process no longer exists, gets deprecated: it leaves provisioning and the repository, and the registry keeps a record of its retirement.

These rules are decided at leadership level: the AI training for executives prepares the leadership team to arbitrate them.

Security: a tested skill is not a safe skill

A skill gives Claude instructions and sometimes code to run. Anthropic’s documentation draws the conclusion plainly.

Depending on the access Claude has, a malicious skill can lead to data exfiltration or unauthorized system access. Anthropic recommends using only skills you wrote or that Anthropic provides, and treating their installation like installing software.

What Anthropic offers, and where it stops

• Skill content scanning, reserved for Enterprise, blocks skills uploaded to claude.ai or Cowork that show signs of hidden code execution or data being sent out. The Help Center states it has been on by default since October 2, 2026, where available.
• It does not cover everything. According to the enterprise guide, it skips skills uploaded through the API or the Console, skills that were already in the organization when it was turned on, and organizations using zero data retention, customer-managed encryption keys or HIPAA readiness (the US health data framework).
• Skills are not covered by ZDR, zero data retention, a contractual commitment under which Anthropic does not keep exchanges after processing, except where the law requires it. The documentation states that skill definitions and execution data follow the standard retention policy.

What the August 2026 research shows

The ElasticBack paper, submitted to arXiv on August 10, 2026, describes a backdoor hidden in a single skill. A rule planted in the document fires only when a harmless-looking trigger appears in the user’s request.

On ordinary requests, the skill stays dormant and produces correct results. The authors report that it almost never fires by mistake: the attack therefore does not give itself away during testing. It transfers across models and evades deployment-time defenses.

An older vector adds to this: instructions hidden in invisible Unicode characters, which the agent reads and the human reviewer does not see. The Claude Code changelog shows these characters are now neutralized in prompts and in memory. That does not remove the need to inspect a skill’s files before installing it.

Three checks before any installation

• Review all the content: the SKILL.md, reference files and scripts, with a tool that reveals invisible characters. In Claude Code, look closely at the allowed-tools field: it restricts nothing, it pre-approves tools without a permission prompt while the skill runs.
• Verify provenance: identified source, pinned version, checksum verified at deployment.
• Restrict permissions: least privilege comes from the organization’s permission rules, which deny a tool or require confirmation, and from withholding network access when the task does not need it. The disableSkillShellExecution setting also blocks the commands a skill injects into its text before Claude reads it; it does not apply to enterprise-managed or bundled skills, and skills synced from claude.ai never run those commands on your machine anyway.

Portability: an open format, partial compatibility

Anthropic published the format as an open standard on December 18, 2025, at agentskills.io. As of October 12, 2026, the site’s list of compatible clients includes Codex, Cursor, GitHub Copilot, VS Code, Gemini CLI and Mistral Vibe, among some forty others.

Compatibility has precise boundaries.

• The safe core: name and description, with a name identical to the folder name, as the specification requires. The allowed-tools field is marked experimental there, with support varying between tools.
• Claude Code-specific fields, such as context, agent, paths or disable-model-invocation, do not carry over. Treat them as local settings.
• The location changes: Codex looks for skills in .agents/skills, at the repository root or in your home folder, not in .claude/skills, according to its documentation. A copy or a symbolic link is enough, since Codex follows links.

On the OpenAI side, three dated facts mark the year.

• On June 2, 2026, OpenAI introduced six role-based Codex plugins bundling 62 apps and 110 skills, as reported by Reworked on June 3.
• On August 6, 2026, OpenAI Developers announced Agent Plugins, an open standard developed with AWS, Cursor, GitHub, VS Code and Vercel. It packages Agent Skills and configurations for MCP servers, MCP being the protocol that connects an agent to external tools and data sources.
• On August 7, 2026, Codex 0.147.0 added installation of portable Agent Plugins and import of Cursor-managed skills.

Anthropic is not among the announced co-developers of Agent Plugins, and Claude Code keeps its own plugin format. The SKILL.md file therefore travels between tools; the packaging still depends on the ecosystem. The CLI agents comparison details these differences tool by tool.

Going further

Writing a first skill takes little time; maintaining a set of skills that are reviewed, versioned and safe takes a method.

• For business teams, the Claude training teaches how to phrase, test and share skills in claude.ai and Cowork.
• For technical teams, the Claude Code training “Claude Code in production” covers locations, plugins, permissions and security review.
• For an IT department organizing its skills, the business AI plugins offering sets up the registry and the review workflow, and helps it choose between Team and Enterprise, and the AI agent security training addresses the risks described above.

Colombani.ai holds Qualiopi certification for training activities. Its founder, Ulysse Trin, holds the Claude Certified Architect Professional, issued by Anthropic.