869 Create Skill 7fb19bc4

# /create-skill - Save Custom Approach as Reusable Skill

Save a successful custom approach as a reusable specialist skill.

## When to Use

After you've helped the user with a custom security testing approach:
- Custom analysis focus (e.g., "focus on API security only")
- Custom priority order (e.g., "check auth before secrets")
- Custom techniques (e.g., "specific testing methodology")
- Successful findings (approach actually worked)

---

## What This Does

Guides skill creation process:

### Step 1: Capture Successful Approach

```
What was successful about this approach?

Examples:
- Custom priorities: Auth → API security → Business logic
- Specific focus: API endpoint authentication testing
- Custom technique: Token generation + endpoint fuzzing
- Domain expertise: Mobile app security patterns
```

### Step 2: Define Skill Parameters

```
Skill name: [descriptive_name]
Trigger keywords: [when should this auto-load?]
Domain: [what type of targets?]

Examples:
- Name: api_security_auth_focus
- Keywords: API, REST, authentication, admin panel
- Domain: Web APIs with authentication
```

### Step 3: Extract Reusable Patterns

Review approach for:
- ✓ Generalizable patterns (not hardcoded to one target)
- ✓ Reusable priorities (applicable to similar targets)
- ✓ Tool combinations (what worked together)
- ✗ Target-specific details (remove these)

### Step 4: Validate Token Budget

```
Skill size: ___ tokens (must be <500 tokens)
Current total skills: ___ (warn if >10 skills)
Session impact: +___ tokens when auto-loaded
```

### Step 5: Create Skill File

Save to: `tiers/specialists/custom/[skill_name].md`

**Skill structure:**
```markdown
# [Skill Name]
# Created: [date]
# Source: Successful approach from [session]
# Token cost: [X] tokens
# Auto-loads: [trigger keywords]

## Core Philosophy
[What makes this approach unique/successful]

## When to Use
[What types of targets/situations]

## Approach
[Successful priorities, techniques, tools]

## Integration with Python
[How this guides Python execution parameters]
```

### Step 6: Test Auto-Loading

Verify skill will auto-load correctly:
- Keywords defined clearly
- File in correct location
- Token budget acceptable

---

## Token Budget Guidelines

**Skill size limits:**
- Minimum: 200 tokens (enough for useful content)
- Recommended: 300-400 tokens (sweet spot)
- Maximum: 500 tokens (hard limit, enforced)

**Total skills warning:**
- Yellow (5 skills): 1,500-2,000 tokens in skills
- Red (10 skills): 3,000-4,000 tokens (approaching budget)
- Critical (15+ skills): Consider consolidating or removing unused

---

## Example Skill Creation

```
User: /create-skill

Claude: What successful approach should we save?

User: "We focused on API authentication, checking auth bypass before anything else, and it found critical issues faster"

Claude:
  ✓ Extracting approach patterns...

  Skill preview:
  - Name: api_auth_priority
  - Keywords: API, REST, authentication, auth bypass
  - Focus: Authentication issues in web APIs
  - Priority: Auth bypass → API security → Input validation
  - Size: 380 tokens ✓

  Create this skill? [Y/n/Customize]

User: Y

Claude: ✓ Created: tiers/specialists/custom/api_auth_priority.md
        Will auto-load when keywords match: API, authentication

        Test it now? Run /scan on API codebase
```

---

## Quality Checks

Before saving skill:
- [ ] Not overfitted to one target (generalized patterns)
- [ ] Token limit respected (<500 tokens)
- [ ] Keywords defined (will auto-load correctly)
- [ ] Approach documented (clear priorities/techniques)
- [ ] Integration clear (how it guides Python parameters)

---

## Maintenance

Skills are stored in: `tiers/specialists/custom/`

**Manage skills:**
- List: `ls tiers/specialists/custom/`
- Disable: Add `.disabled` suffix to filename
- Remove: Delete file
- Edit: Modify file directly

**Quarterly review prompt** (if 5+ skills exist):
```
Review custom skills? Usage stats available.
```