What Skills Should I Add to Claude Code? A Practical Starting Set

Start With What's Already in the Box

Before you install a single third-party skill, it's worth knowing that Claude Code already ships with a working set. The official documentation lists these bundled skills as available out of the box: /doctor, /run, /verify, /run-skill-generator, /claude-api, /code-review, /debug, /loop, and /batch. Each one covers a common development task, from diagnosing your setup to reviewing code and running structured debugging sessions.

Why start here? Trust. Every bundled skill comes from Anthropic itself, so you make no third-party trust decisions when you use them. That matters more than it might seem. Snyk's audit of 3,984 published skills found that 13.4% contained at least one critical security issue, and 36.82% had some security issue at all. A skill isn't just a prompt; it inherits your agent's full permissions, including shell access, file read/write, and credential access. Installing one is a genuine security decision, so deferring those decisions until you actually need to make them is the sensible default.

The bundled set is also a good teacher. Run /doctor and you'll see how Claude Code diagnoses installation, extensions, CLAUDE.md, and permission issues. Run /code-review and you'll see what a structured review procedure looks like in practice. These are templates for how to think about the skills you'll eventually write or install yourself.

So when should you actually add something new? The official trigger test is refreshingly concrete: create a skill when you keep pasting the same instructions, checklist, or multi-step procedure into chat, or when a section of your CLAUDE.md has grown into a procedure rather than a fact. That second condition is the one most people miss. Your CLAUDE.md should hold facts and preferences. The moment a section reads like a step-by-step workflow, it has become a skill waiting to happen.

A few candidates that fit this test well:

• Weekly status updates, where the format and content requirements repeat every time
• Customer call summaries with a standard structure
• Test-driven development workflows for developers
• Research briefs or first-pass document review with consistent criteria

Notice the pattern: these are your own repeated procedures, not generic "capability" skills promising to make the agent smarter. A skill that encodes a workflow you actually perform will beat a vague one every time, because it captures real organizational knowledge: what to do, in what order, and with what guardrails.

Once you've exhausted the bundled set and your own procedures, you'll eventually want third-party skills. That's where vetting becomes essential, since stars and download counts can be manufactured and even well-reviewed skills can carry hidden risks. When you get there, the free directory at SkillzBench pins every skill to a commit SHA, security-scans it, and publishes benchmark results showing each skill's measured Lift, so you can decide with evidence rather than vibes.

Add Skills That Match Your Repeated Workflows

Once you've worked with Claude Code's bundled skills for a while, you'll start noticing the moments when you keep typing the same instructions into chat. That's the signal for your second wave of skills, and it should be personal rather than generic.

The official guidance is direct: create a skill when you keep pasting the same instructions, checklist, or multi-step procedure, or when a section of CLAUDE.md has grown into a procedure rather than a fact. A practitioner enterprise guide puts it well: think of a skill as an executable operating procedure that holds the same information as a good internal playbook, plus the templates and deterministic scripts to perform the work.

So what does that look like in practice? The candidates split cleanly along role lines.

For developers, the curated catalog highlights test-driven-development, software-architecture, root-cause-tracing, and webapp testing as concrete starting points. These encode judgment-heavy procedures that are hard to remember in full and easy to get wrong under deadline pressure.

For business users, the enterprise guide recommends starting from one frequent, valuable, inconsistent task and suggests weekly status updates, customer call summaries, research briefs, first-pass contract issue spotting, experiment analysis, and QBR prep. Each of these turns a recurring multi-step process into a single command.

Before you build that second wave, it's worth understanding what skills actually are, because the terminology gets confusing fast. Skills are not MCP servers and not tools. MCP handles connections to external systems, tools handle individual actions, and skills define the workflow: what to do, in what order, with what guardrails. A useful framing from security research: tools provide new capabilities, while skills provide structured expertise.

That distinction matters for a practical reason. At session start, the agent sees only each skill's name and description, roughly 100 tokens per skill. The full SKILL.md body (typically under 5,000 tokens) loads only when relevant, and auxiliary scripts and references load on demand. This three-layer architecture (Discovery, Activation, Execution) is what makes a large skill library affordable. You can keep hundreds of procedures available without paying a context-window tax for any of them.

The security stakes make careful sourcing non-negotiable. Snyk's audit of 3,984 skills found 13.4% contained at least one critical security issue, and a separate analysis found roughly 26% of skills carry at least one vulnerability. Curated sources fared dramatically better: the skills.sh top-100 showed 0% false positives on critical detectors and materially lower exposure across every threat category compared with the open marketplace. That gap is exactly why your second wave should come from a verified directory rather than the first search result. SkillzBench pins every skill to a commit SHA, security-scans and license-checks it, and publishes a 0–100 trust score alongside separate Lift benchmarks from sandbox testing, so you can see both safety and effectiveness before you install anything. Browse verified skills free at skillzbench.com.

Why Sourcing Matters More Than Selection

The scariest part of adding skills isn't picking the wrong one. It's picking a popular one. Publishing a skill takes nothing more than a SKILL.md file and a week-old GitHub account, with no code signing or security review by default, according to Snyk's audit of 3,984 skills. Their scan found 13.4% contained at least one critical security issue, 36.82% had some security issue, and 76 carried confirmed malicious payloads.

The damage isn't theoretical. Mitiga built a proof-of-concept skill that silently exfiltrated an entire codebase in just four user interactions, and the audit logs came back empty. Because skills inherit the agent's full permissions, including shell access and credential access, a one-click install can wire data theft directly into your workflow before you notice anything is wrong.

And the signals people usually rely on don't help. Star counts and upvotes can be inflated by bots, as Mitiga points out, so a skill with thousands of stars tells you nothing about its safety. Snyk's own framing puts it bluntly: if you installed a skill in the past month, there's roughly a 13% chance it contains a critical flaw. Vibes are not a vetting strategy.

Here's the encouraging part: curation works. In Snyk's data, the curated skills.sh top-100 showed a 0% false-positive rate on critical detectors and materially lower exposure across every threat category compared with the open ClawHub marketplace. Prompt injection: 0.0% versus 2.6%. Malicious code: 0.0% versus 5.3%. Where a skill comes from predicts its risk better than anything on its landing page.

That's why SkillzBench treats sourcing as the whole game. Every skill in its free directory is pinned to a specific commit SHA, so what you reviewed is exactly what you get. Each version is security-scanned, license-checked, and quality-judged, then rolled into a 0–100 trust score built from security, quality, license, maintenance, and community signals. And because a safe skill can still be useless, every skill is also run in a sandbox with the same model, with and without the skill, so you can see the measured Lift before you commit.

If you're vetting on your own, the security researchers converge on a short checklist:

• Only install from trusted, curated sources; treat open marketplaces as unvetted by default.
• Review a skill's instructions before enabling it, and flag anything that silences output or auto-allows actions as a red flag.
• Validate what a skill says it does against what it actually does at runtime, and require human confirmation for high-impact actions.
• Don't trust star counts or download numbers as evidence of safety.

Vetting beats vibes, every time. A curated, verified source does the boring work of scanning, pinning, and benchmarking so your starting set is built on evidence rather than popularity. Browse the free directory at skillzbench.com and see the trust scores and Lift results for yourself.

Your 30-Minute Vetting and Installation Routine

Fifteen minutes of reading now saves you from installing a skill that quietly exfiltrates your codebase later. Security researchers at Mitiga demonstrated exactly that: a proof-of-concept skill that silently shipped an entire repository to an attacker in just four user interactions, leaving empty audit logs behind.

The risk isn't theoretical. Snyk's audit of 3,984 skills found 13.4% carry at least one critical security issue, and 36.82% have some security problem. Since skills inherit your agent's full permissions (shell access, file read/write, credentials), every install is a trust decision.

Here's the routine that keeps installs deliberate. Budget about 30 minutes per skill the first few times; it gets faster.

• Read the SKILL.md body before enabling. Mitiga specifically recommends flagging silencing or allowlist instructions as red flags, since they can hide malicious behavior from review.
• Validate the description against runtime behavior. Akamai's threat guidance warns that a skill's stated purpose can diverge from what its scripts actually execute.
• Apply least privilege. Give the skill only the file paths and commands it needs, not blanket access to your repo and credentials.
• Require human confirmation for high-impact actions. Anything that pushes code, sends messages, or touches production should stop and ask you first.
• Test empirically, with and without the skill. Run the same task both ways and compare output quality before you adopt it.

That last step matters more than most people realize. A skill's value is its measurable effect on your results, not its star count or its description. Mitiga warns that upvotes and download tallies are trivially inflated by bots, so popularity tells you almost nothing about safety or usefulness.

This is where curation earns its keep. Snyk's data shows skills from curated top-100 lists had a 0% false-positive rate on critical detectors and far lower exposure across every threat category than the open marketplace (prompt injection: 0.0% vs 2.6%). Vetting from a filtered pool simply works better than vetting from a firehose.

SkillzBench's per-agent loadouts close the loop on this routine. You toggle exactly which skills and tools each agent sees, so nothing gets loaded by accident, and the free directory pins every version to a commit SHA with security scans and trust scores before you ever install.

Do this consistently and you'll build a starting set you actually trust. Thirty minutes per skill feels slow until the first time a bad one gets caught at the door.

ctaText: Browse verified skills on SkillzBench socialProofText: Hundreds of skills scanned, benchmarked, and trust-scored, free at skillzbench.com.