---
description: Save a custom approach as a reusable skill
dispatch: skill
---

# /create-skill - Save Custom Approach as Reusable Skill

Save a successful custom approach as a reusable specialist skill.

## When to Use

After you've helped the user with a custom security testing approach:
- Custom analysis focus (e.g., "focus on API security only")
- Custom priority order (e.g., "check auth before secrets")
- Custom techniques (e.g., "specific testing methodology")
- Successful findings (approach actually worked)

---

## What This Does

Guides skill creation process:

### Step 1: Capture Successful Approach

```
What was successful about this approach?

Examples:
- Custom priorities: Auth → API security → Business logic
- Specific focus: API endpoint authentication testing
- Custom technique: Token generation + endpoint fuzzing
- Domain expertise: Mobile app security patterns
```

### Step 2: Define Skill Parameters

```
Skill name: [descriptive_name]
Trigger keywords: [when should this auto-load?]
Domain: [what type of targets?]

Examples:
- Name: api_security_auth_focus
- Keywords: API, REST, authentication, admin panel
- Domain: Web APIs with authentication
```

### Step 3: Extract Reusable Patterns

Review approach for:
- ✓ Generalizable patterns (not hardcoded to one target)
- ✓ Reusable priorities (applicable to similar targets)
- ✓ Tool combinations (what worked together)
- ✗ Target-specific details (remove these)

### Step 4: Validate Token Budget

```
Skill size: ___ tokens (must be <500 tokens)
Current total skills: ___ (warn if >10 skills)
Session impact: +___ tokens when auto-loaded
```

### Step 5: Create Skill File

Save to: `.claude/skills/[skill_name]/SKILL.md` (the
canonical Claude Code skills directory). For
single-file skills, `.claude/skills/[skill_name].md`
also works — Claude Code's skill discovery walks
`.claude/skills/` and picks up both layouts.

(Pre-fix this said `tiers/specialists/custom/[name].md`.
That path is from an earlier RAPTOR layout that
predates Claude Code's skills mechanism — files there
aren't auto-loaded by Claude Code today, so saving
new skills there would have made them invisible to
the LLM. Existing files under `tiers/personas/` are
still loaded via explicit prompts and via the Python
methodology loader, but new skills should go under
`.claude/skills/` for auto-load.)

**Skill structure:**
```markdown
# [Skill Name]
# Created: [date]
# Source: Successful approach from [session]
# Token cost: [X] tokens
# Auto-loads: [trigger keywords]

## Core Philosophy
[What makes this approach unique/successful]

## When to Use
[What types of targets/situations]

## Approach
[Successful priorities, techniques, tools]

## Integration with Python
[How this guides Python execution parameters]
```

### Step 6: Test Auto-Loading

Verify skill will auto-load correctly:
- Keywords defined clearly
- File in correct location
- Token budget acceptable

---

## Token Budget Guidelines

**Skill size limits:**
- Minimum: 200 tokens (enough for useful content)
- Recommended: 300-400 tokens (sweet spot)
- Maximum: 500 tokens (hard limit — keep to it; not mechanically enforced)

**Total skills warning:**
- Yellow (5 skills): 1,500-2,000 tokens in skills
- Red (10 skills): 3,000-4,000 tokens (approaching budget)
- Critical (15+ skills): Consider consolidating or removing unused

---

## Example Skill Creation

```
User: /create-skill

Claude: What successful approach should we save?

User: "We focused on API authentication, checking auth bypass before anything else, and it found critical issues faster"

Claude:
  ✓ Extracting approach patterns...

  Skill preview:
  - Name: api_auth_priority
  - Keywords: API, REST, authentication, auth bypass
  - Focus: Authentication issues in web APIs
  - Priority: Auth bypass → API security → Input validation
  - Size: 380 tokens ✓

  Create this skill? [Y/n/Customize]

User: Y

Claude: ✓ Created: .claude/skills/api_auth_priority/SKILL.md
        Will auto-load when keywords match: API, authentication

        Test it now? Run /scan on API codebase
```

---

## Quality Checks

Before saving skill:
- [ ] Not overfitted to one target (generalized patterns)
- [ ] Token limit respected (<500 tokens)
- [ ] Keywords defined (will auto-load correctly)
- [ ] Approach documented (clear priorities/techniques)
- [ ] Integration clear (how it guides Python parameters)

---

## Maintenance

Skills are stored in: `.claude/skills/`

**Manage skills:**
- List: `ls .claude/skills/`
- Disable: Add `.disabled` suffix to the skill directory or file
- Remove: Delete the skill directory (or the bare `.md` file)
- Edit: Modify the skill's `SKILL.md` (or single-file `.md`) directly

(Pre-fix this section pointed at `tiers/specialists/custom/` —
an earlier RAPTOR layout that predates Claude Code's skills
mechanism. Files there aren't auto-loaded today, so saving
new skills there made them invisible to the LLM.)

**Quarterly review prompt** (if 5+ skills exist):
```
Review custom skills? Usage stats available.
```