Skills deep dive

Claude Skills for Australian small business: the reusable capability layer, the Projects-Skills-Agents mental model, and the five skills we ship most

The Australian SMB deep dive on Claude Skills in 2026. The three-layer mental model (Projects = who Claude works for, Skills = what Claude knows how to do well, Agents = how Claude does work in the world). When Skills win vs Projects vs Agents, the anatomy of a good Skill, five AU SMB Skill walkthroughs with the actual SKILL.md content, distribution patterns, and the security considerations.

In short

The Australian SMB deep dive on Claude Skills in 2026. The three-layer mental model: Projects = who Claude works for (your voice, your context). Skills = what Claude knows how to do well (a specific competence packaged for reuse). Agents = how Claude does work in the world (a loop that orchestrates the other two). This piece is the practical map: when Skills win vs Projects vs Agents, the anatomy of a good Skill, five AU SMB Skill walkthroughs with the actual SKILL.md content you can copy, how to distribute Skills across team and agency-client, the security considerations, and the economics versus prompts and agents.

Why this piece exists

Most operators we audit have one of two architectures:

Architecture A: A Claude Project per business (good) + ad-hoc prompts (forgettable, non-reusable, dies when the operator goes on holiday).

Architecture B: One monolithic agent with a 4000-word prompt trying to do everything (works at 60% reliability, breaks weekly, impossible to debug).

The right architecture in 2026 is Architecture C: Project for context + Skills for reusable capabilities + Agents (where needed) that compose Skills. Most SMB AI publishing doesn’t cover this because it’s recent (2025-2026 Skills tooling matured) and because most enterprise AI writers don’t write at SMB scale.

This piece is the canonical Australian SMB guide to the Skills layer specifically.

Part 1: The three-layer mental model

The single most useful mental model in 2026 Claude work. Once it clicks, AI architecture decisions get much faster.

Projects: WHO Claude works for

A Claude Project is a folder of persistent context, voice file, knowledge files, brand guidelines, past examples. Every chat inside the Project starts with Claude already knowing this material.

Examples of Project content:

  • Your voice file (who you sound like)
  • Your product / service list
  • Your past customer emails
  • Your brand guidelines
  • Your no-no list

A Project answers the question: WHO is Claude talking to / working for?

Skills: WHAT Claude knows how to do well

A Skill is a packaged competence. Claude invokes the Skill when the trigger matches. The Skill contains the instructions, the patterns, optionally scripts and resources.

Examples of Skills:

  • Draft an Australian customer reply in our voice
  • Run a BAS sanity check on these figures
  • Generate three platform-specific social captions for this week’s update
  • Extract data from this invoice / receipt
  • Review this content against AU Consumer Law

A Skill answers the question: WHAT specific competence is Claude using right now?

Agents: HOW Claude does work in the world

An Agent is a loop that takes inputs, decides which Skills to invoke against which Project context, executes, observes, decides again. An Agent runs without a human in the seat for some part of its lifecycle.

Examples of Agents (covered in our Agents flagship):

  • Overnight customer service triage
  • Inventory low-stock monitor
  • Lead enrichment + outreach drafting
  • Weekly briefing producer
  • Document processor for bookkeeping

An Agent answers the question: HOW does the work actually happen in the world?

The architecture, drawn out

[ Project: WHO ] ← persistent context
       |
       v
[ Skill: WHAT ] ← reusable competence
       |
       v
[ Agent: HOW ] ← orchestrated loop
       |
       v
[ Action in the world ]

A real example: the overnight customer service triage agent (from our Agents flagship) uses:

  • The “Brunswick Cafe” Project (voice, menu, past customer correspondence)
  • The “Draft Australian customer reply” Skill (the actual drafting competence)
  • The “Classify customer intent” Skill (booking vs enquiry vs complaint)
  • The “Summarise customer thread” Skill (collapse a multi-message thread)
  • Wrapped in an Agent loop that runs at 6am AEST, reads the inbox, invokes the right Skills against the right Project, queues outputs for human review.

The agent is short. The Skills carry the knowledge. The Project carries the context.

Part 2: When Skills win (5 signals)

You should build a Skill, not just write a prompt or build a giant agent, when:

Signal 1: You’ve run the same prompt 3+ times in different contexts

If you’ve drafted “an Australian customer reply” three times, you’ve already discovered the prompt patterns that work. Package them as a Skill so you don’t lose the knowledge.

Signal 2: Multiple people on your team need to do the same thing

Skills are the team-knowledge-transfer layer. A new starter inheriting a well-documented Skills library produces the same quality output on day one as a 6-month veteran. The Skill is the institutional memory.

Signal 3: You want to use the competence inside an Agent

Agents that call Skills are dramatically more maintainable than agents with monolithic prompts. If you’re thinking about building any kind of agent, decompose into Skills first.

Signal 4: You want the prompt to evolve over time without breaking history

A Skill in version control gives you change history. You can see how “Draft Australian customer reply” evolved over 6 months, which changes improved quality, which broke things. Pure-prompt approaches lose this.

Signal 5: The competence has clear inputs and outputs

Skills work best when the I/O is bounded. “Draft a customer reply” has a clear input (the customer email) and output (the draft). “Help me think about my business strategy” doesn’t have bounded I/O and is wrong for the Skill format.

Part 3: When Skills are wrong (5 signals)

You should NOT build a Skill, and should stay with chat / Project / prompt, when:

Signal 1: You’ve only done this once

Don’t package a one-shot into a Skill. The Skill should embed knowledge you’ve earned by repetition. One-shots are prompts.

Signal 2: The competence is highly contextual

Some work is genuinely bespoke per situation: strategic decisions, relationship-laden customer interactions, creative work that needs fresh thinking each time. These resist the Skill format.

Signal 3: The inputs are wildly varied

Skills assume bounded inputs. If your inputs swing between 30-word emails and 50-page contracts, a single Skill won’t handle both well. Either split into two Skills or stay with adaptive chat.

Signal 4: You’re a solo operator using AI 1-2 times a day

The Skills overhead (writing them, maintaining them) isn’t worth it at low volume. Stay with Projects + prompts until you’re using AI 5+ times daily on recurring tasks.

Signal 5: The competence is changing rapidly

If the underlying knowledge is in flux (new product launching weekly, new regulations changing the rules), the Skill will be out of date before you can use it. Wait for stability.

Part 4: The anatomy of a good Skill

A Skill is a folder. The folder contains:

SKILL.md (required)

The instructions. Markdown. 30-200 lines for most SMB Skills.

Structure:

# [Skill name]

## When to use this skill
[Specific triggers, what kind of input / question / task]

## Inputs
[What the user provides]

## Outputs
[What the Skill produces]

## Process
[Step-by-step what Claude does]

## Voice / tone
[How the output should sound]

## Edge cases
[How to handle the tricky inputs]

## What this Skill is NOT for
[Explicit non-uses to prevent misapplication]

scripts/ (optional)

Executable scripts the Skill can invoke. Bash, Python, Node, whatever your Claude Code environment supports.

Common patterns:

  • A script to fetch data from an external API
  • A script to validate output format
  • A script to write the output to a specific location

resources/ (optional)

Reference data the Skill reads but doesn’t execute. Files, templates, example outputs, glossaries.

Common patterns:

  • Past examples of good output
  • A template the output should match
  • A glossary of terms specific to the Skill

Where it lives

Claude Code: .claude/skills/[skill-name]/ in your project repo or ~/.claude/skills/[skill-name]/ for personal skills.

Claude Agent SDK: registered with the agent at startup; the SDK loads SKILL.md, scripts, and resources into the agent’s available capability set.

Part 5: The five Skills we ship most often

Across DotVA implementations, these five Skills account for ~60% of what we package. Each one is the actual SKILL.md content you can copy + adapt + ship.

Skill 1: Draft an Australian customer reply

Used by: every service business. Triggered when the operator pastes a customer email and asks “draft a reply”.

# Draft Australian customer reply

## When to use this skill
The user has pasted a customer email or DM and needs a reply
drafted in their voice. Trigger phrases include "draft a reply",
"how should I respond to this", "write back to this customer".

## Inputs
- The full customer email or message thread (paste as text)
- Optional: any context the user wants to mention (existing
  relationship, prior commitments, urgency level)

## Outputs
A draft reply that:
- Matches the voice file in the Project Instructions
- Is appropriately short (under 80 words unless the email genuinely
  needs more)
- Includes one concrete next step
- Uses Australian English (organised, colour, centre)
- Does NOT make commitments not in the project context (no quoting
  prices, no promising dates, no agreeing to scope changes)

## Process
1. Read the customer email carefully. Identify the actual ask
   underneath any pleasantries.
2. Classify intent: enquiry, complaint, booking, supplier, FYI,
   personal. Skip drafting for FYI / spam.
3. Check the Project context for any prior correspondence with this
   customer or any prior commitments.
4. Draft the reply in the operator's voice, matching the past-email
   samples in PAST_REPLIES.md if present.
5. End with a concrete next step (a phone time, a confirmation
   request, a specific deliverable date).

## Voice / tone
Friendly Australian, plain English, warm but not gushing. No
exclamation marks. No corporate-speak. Direct without being curt.

## Edge cases
- If the customer is angry: acknowledge the situation explicitly
  in the first sentence, offer a concrete next step, don't be
  defensive
- If the customer is asking for something we can't deliver: be
  honest, explain briefly, offer the closest alternative we can
  provide
- If the customer's email is unclear: ask ONE clarifying question
  rather than guessing; never assume

## What this Skill is NOT for
- Legal / regulated correspondence (use specialist skills)
- Sales prospecting (use the outreach Skill)
- Hard conversations (firing, declining, complaint escalation, 
  these need the operator to write themselves)

Skill 2: BAS / IAS sanity checker

Used by: bookkeepers, BAS agents, accountants. Triggered when an operator pastes draft BAS figures.

# BAS / IAS sanity check

## When to use this skill
The user (a BAS agent / accountant / bookkeeper) is about to lodge a
BAS or IAS and wants a sanity check before submission. Trigger
phrases include "check this BAS", "BAS sanity check", "review my
quarterly figures".

## Inputs
Required:
- This period's BAS or IAS figures (G1 sales, 1A GST collected,
  G11 purchases, 1B GST paid, W1 wages, W2 PAYG withholding, etc.)
- Last period's figures (same fields, for comparison)

Optional:
- Notes from the user about any unusual events this period (new
  product launch, one-off large sale, supplier change, etc.)

## Outputs
A structured anomaly report with:
- GST internal consistency: collected vs sales should imply ~1/11
- Period-over-period comparison: anything moved more than 15%
  flagged for review
- PAYG vs wages: ratio sanity
- Specific anomalies with the suggested investigation
- Confidence level: high / medium / low

## Process
1. Compute implied GST rate (1A / G1). Flag if outside 9.0%-9.2%.
2. Compare each line to last period. Flag movements >15% absent
   user-provided context.
3. Check PAYG (W2) vs wages (W1). Should be roughly 18-32% for most
   businesses; outside this range warrants investigation.
4. Cross-check zero values: are they explained or anomalous?
5. List anomalies in priority order, with the specific
   investigation step recommended.

## Voice / tone
Direct, professional, anomaly-focused. Don't be reassuring; surface
the issues. Australian English. Use "investigate", not "you may
wish to consider".

## Edge cases
- If this is the first BAS for a new business: skip period-over-
  period and focus on internal consistency only
- If there's a one-off large transaction: note it as the likely
  explanation but don't dismiss; the user confirms
- If figures look reasonable: say so clearly. False positives are
  worse than false negatives in this domain.

## What this Skill is NOT for
- Lodging the BAS, that's a registered agent action
- Tax planning advice, that's specialised work
- Cross-period reconciliation, separate Skill

## Important compliance note
This is a sanity check, not BAS preparation. The registered BAS or
tax agent retains professional accountability for lodgement under
TPB rules. AI assists; the human signs.

Skill 3: Australian-tone social caption generator

Used by: any operator running social. Triggered when operator wants captions for a specific update.

# Australian-tone social caption generator

## When to use this skill
The user wants social media captions for a specific business update.
Trigger phrases include "write social posts about", "draft captions
for", "Instagram caption for".

## Inputs
Required:
- The update / event / product / news in 1-3 sentences
- Target platforms (Instagram / LinkedIn / Facebook / X)

Optional:
- Specific call-to-action (visit us, book a table, buy now, etc.)
- Photo description if relevant (so caption matches visual)
- Posting context (weekday morning / Friday night / weekend, etc.)

## Outputs
Per platform, the right number of variants in the right format:
- Instagram: 3 variants, 80-150 words each, 5-8 hashtags max
- LinkedIn: 1-2 variants, 200-400 words, professional warmth,
  hashtags optional
- Facebook: 2 variants, 80-120 words, conversational, often
  question-driven
- X / Twitter: 3 variants, 200 chars max, pithy

All variants:
- Match the voice file in the Project Instructions
- Use Australian English (organised, colour, centre)
- No exclamation marks unless the Project voice file specifically
  allows
- Include suggested posting time per platform (defaulting AEST)

## Process
1. Read the voice file in the Project Instructions and PAST_POSTS.md
   if present.
2. For each platform, draft variants matching the platform-specific
   structure rules.
3. Each variant has a different angle: one product/showcase, one
   story/behind-the-scenes, one community/audience.
4. End each variant with a soft call-to-action matching the
   business's typical style.
5. Suggest hashtags (Australian-relevant, mix of broad + niche).
6. Suggest posting time based on industry + platform conventions.

## Voice / tone
Match the voice file. Default: warm Australian, conversational,
slightly cheeky if the voice file permits. Avoid: corporate-speak,
"use", "unleash", "full", emoji unless voice file
allows.

## Edge cases
- If the update is sensitive (loss, controversy, apology): produce
  ONE careful variant per platform, not three. Flag for the
  operator to write themselves if it's serious.
- If the update is purely promotional (sale, discount, urgency):
  produce variants that don't sound salesy; AU audiences punish
  hard-sell on social.
- If the operator hasn't given a photo description but the platform
  is image-heavy (Instagram): ask which photo will accompany.

## What this Skill is NOT for
- Strategy (which platforms, which audience)
- Long-form blog content (separate Skill)
- Paid ads (separate Skill, different constraints)

Skill 4: Australian invoice + receipt extractor with GST

Used by: bookkeepers, accountants, anyone processing AU invoices.

# Australian invoice + receipt extractor

## When to use this skill
The user has uploaded an image / PDF of an Australian invoice or
receipt and needs structured data extracted for accounting use.
Trigger phrases include "extract from this receipt", "process this
invoice", "what's on this document".

## Inputs
Image or PDF of an Australian invoice or receipt. Vision-capable
model required (Claude 4.6+ Sonnet or Opus).

## Outputs
A structured extraction:
- Vendor name + ABN (if visible)
- Invoice / receipt number
- Date (DD/MM/YYYY format)
- Line items with quantity, description, unit price, line total
- Subtotal (ex-GST)
- GST component
- Total (inc-GST)
- Payment method (if shown)
- GST-registered: yes/no/unclear (flag if ABN ends with valid
  check digit and GST is broken out separately)
- Suggested Xero account code with 1-line reasoning
- Confidence: high / medium / low per field

## Process
1. OCR the document.
2. Identify vendor + ABN.
3. Parse line items, summing to subtotal.
4. Extract or compute GST (10% of taxable supplies).
5. Identify payment method if shown.
6. Map to most likely Xero account code based on vendor + line
   description.
7. Flag any anomalies: missing ABN on $1000+ invoice (RCTI risk),
   GST broken out but ABN not GST-registered (compliance issue),
   handwritten / partially damaged fields.

## Voice / tone
Structured output. Match Xero's expected format. No prose, pure
data extraction with confidence flags.

## Edge cases
- Multi-currency invoice: extract original currency + Australian
  conversion if shown; flag currency for the bookkeeper.
- Partial damage / illegibility: extract what you can; mark each
  unclear field with low confidence and the specific issue.
- Missing GST breakdown on $1000+ invoice: flag for human review
  before accepting (RCTI obligations may apply).
- Foreign vendor (no ABN): flag for GST treatment, likely reverse
  charge under GST Act if registered for GST.

## What this Skill is NOT for
- Posting to Xero, that's the agent's action, not the Skill's
- Receipt scanning at scale, use Hubdoc / Dext (this Skill is for
  edge cases those tools choke on)
- BAS preparation, separate Skill

## Important compliance note
Output is suggestion only. The registered BAS or tax agent retains
professional accountability for actual classifications and
lodgement.

Skill 5: AU compliance reviewer (ACL, ATO, Privacy Act)

Used by: any operator publishing marketing content, especially in regulated industries.

# AU compliance reviewer

## When to use this skill
The user is about to publish marketing content (website page,
ad copy, social post, brochure, email campaign) and wants a
compliance check before going live. Trigger phrases include
"compliance check this", "is this OK to publish", "review for
ACL / ATO / Privacy".

## Inputs
Required:
- The draft content
- Context: what is this for (which audience, which channel)
- The business type / industry (so industry-specific rules apply)

## Outputs
A structured compliance report with:
- Australian Consumer Law (ACL) check: any misleading or deceptive
  claims under s18, any false-or-misleading representations under
  s29, any unconscionable conduct risks
- ATO / TPB check (if financial / tax content): any tax advice
  that requires TPB registration, any guarantees of outcomes
- Privacy Act check: any collection notices needed, any cross-
  border disclosure flags, any sensitive-information handling
- Industry-specific check (if relevant): AHPRA (allied health,
  dental, medical), ASIC (financial planning, mortgage), TGA
  (therapeutic goods), Liquor Act, etc.
- Severity per finding: must-fix / should-fix / consider
- Specific fix recommended per finding

## Process
1. Read the content against ACL s18 (misleading conduct) and s29
   (false or misleading representations). Flag specific claims.
2. Read against ACL s51-s55 (consumer guarantees and unfair
   contract terms). Flag any "no returns ever" or similar.
3. Identify any statistic / claim that needs a source.
4. Identify any guarantee of outcome that's actionable.
5. Identify any testimonial / review usage, needs to be genuine
   and recent under ACL.
6. If financial / tax / health / legal industry: apply the
   industry-specific overlay.
7. Identify privacy issues: data collection without notice, third-
   party PII used without consent, etc.
8. Produce the structured report with severity and specific fixes.

## Voice / tone
Professional, direct, fix-focused. Not legal advice, clear about
that. But concrete: "the phrase X violates ACL s29 because Y; fix
to phrase Z".

## Edge cases
- Comparative advertising (vs competitor): tighten the standard;
  comparison must be true, demonstrable, not misleading
- Health claims: TGA rules are strict; default to flag-for-
  professional-review on any health claim
- Financial advice: ASIC RG 175 + general / personal advice
  distinction; default to flag
- Testimonials: must be genuine, recent, representative

## What this Skill is NOT for
- Legal advice, flag content for a lawyer to review on serious
  issues
- Trademark / IP checks, separate specialist domain
- Defamation checks, flag for legal review

## Important note
This is a content sanity check, not a legal opinion. For high-
stakes content (medical claims, financial advice, comparative
advertising at scale, regulated industry copy) the human author
should also get legal / professional review.

Part 6: Composing Skills inside an Agent

The architectural pattern that makes both work together.

A real-world example from a DotVA build, simplified: the overnight customer service triage agent for a cafe.

Agent: Overnight customer service triage
Project context: "Marlowe's Cafe Brunswick" (voice + menu + past replies)
Skills used:
  1. Read inbox via Gmail MCP
  2. Classify customer intent (Skill)
  3. Summarise customer thread (Skill)
  4. Draft Australian customer reply (Skill, from Part 5 above)
  5. Prioritise queue for human review (Skill)
  6. Output structured report (Skill)

The agent loop:

# Pseudocode of the agent loop
for email in inbox.fetch_overnight():
    summary = SKILL_summarise(email)
    intent = SKILL_classify(summary)
    if intent == "spam":
        archive(email)
        continue
    if intent in ["enquiry", "booking", "complaint"]:
        draft = SKILL_draft_reply(email, project_context)
        priority = SKILL_prioritise(email, intent)
        queue.add(email, draft, priority)
output = SKILL_format_report(queue)
notify_operator(output)

The agent code is short. The Skills carry the knowledge. Each Skill is independently testable, debuggable, version-controlled, swappable.

Compare to the monolithic-prompt alternative:

Agent: One giant prompt
"You are an overnight email triage assistant for Marlowe's Cafe in
Brunswick. The owner Olivia has a warm but no-nonsense Australian
tone. She runs a 25-seat cafe with a brunch + coffee focus. The
menu includes... [3000 more words]. When you read each email, you
should classify it, summarise it, draft a reply, prioritise it,
and produce a structured report... [2000 more words]."

The monolithic version works at 60% reliability. Updates require re-reading 5000 words. Debugging requires guessing which part of the prompt caused the bug. New starters can’t safely modify it.

The Skills-based version works at 85-95% reliability per Skill, fails predictably (you know which Skill broke), updates surgically (touch one Skill, the rest stay stable), and onboards new team members through documented competences.

This is why “one big agent prompt” is the wrong default and “small agent + composed Skills + Project context” is the right one.

Part 7: Distribution patterns

How to share Skills across team, between operators, and (cautiously) from third parties.

Internal: team Skills library

Pattern: a private git repo holding all your business’s Skills. Each team member pulls it down into their .claude/skills/. Updates are PR-reviewed and pulled.

For a DotVA client, we typically ship a Skills pack:

  • skills/ folder with 5-15 Skills tuned to the client
  • A README.md explaining each
  • A sync script (or just git pull)
  • Quarterly review cadence to refresh based on what’s working

Agency-to-client: maintained Skills packs

When DotVA builds an agent for a client, the Skills are part of the deliverable. Pattern: client owns the Skills (they own the IP), we maintain them under a retainer arrangement, or we hand them off completely at end of engagement.

The discipline: the Skills should be readable by the client. Plain markdown, no obscure tooling, no proprietary glue. The client can take the Skills to another agency if they want.

External: marketplaces and public Skills

Mid-2026 emerging:

  • Claude Code plugin documentation + emerging community skill catalogues (no official Anthropic marketplace at time of writing)
  • Community Skills repos on GitHub
  • Skills bundled with Claude Code plugins

Use with caution. Treat third-party Skills like third-party npm packages: read the source, check the publisher, install only if you trust the chain.

Personal: your own evolving Skills library

The pattern most solo operators converge on: a personal ~/.claude/skills/ folder with 5-10 Skills you’ve built over months, version-controlled in a private git repo so you can sync across machines.

Part 8: The security considerations

Skills are code (sort of). The security flagship Part 1.4 covers MCP supply chain risk; the same applies to Skills.

Skills can include executable scripts

A SKILL.md is just markdown. But Skills can include scripts in scripts/ that Claude can invoke. A malicious Skill installed from a community repo can run arbitrary code on your machine.

Skills can include external API calls

Skills that fetch data from external APIs become part of your supply chain. They can leak data, become unavailable, or be compromised.

Mitigations:

  1. Read every Skill before installing. SKILL.md is markdown, read it. scripts/ are code, read them too. If you can’t read the code, don’t install.
  2. Prefer official Anthropic Skills. They’re audited and signed.
  3. Build your own for business-critical work. Five custom Skills tuned to your business will outperform 50 generic community Skills.
  4. Keep Skills in version control. Diff Skills before pulling updates. Reject changes that don’t make sense.
  5. Scope Skills tightly. A Skill that does one thing has a narrower blast radius than a Skill that does ten.

The full security treatment is in our AI security flagship, Skills inherit the same defensive patterns as MCP servers.

Part 9: The economics, Skills vs prompts vs agents

When does Skills pay back vs just writing better prompts?

Skills cost more upfront

A good Skill takes 30-60 minutes to write the first time. A prompt takes 30 seconds. For low-frequency work, prompts win.

Skills compound faster

By the 5th use of a Skill, the time saved exceeds the time spent writing. By the 20th use, the Skill is 10x cheaper than re-writing the prompt each time.

Skills are necessary for production agents

You can’t ship a maintainable agent without Skills. The agent + Skills architecture is the only one that survives the first month of production drift.

Worked example: customer reply drafting

ApproachSetup timeCost per useQualityReusable?
Ad-hoc prompt each time02 min thinking + AI callVariableNo
Project with prompt template in Instructions30 min30 secConsistentWithin Project only
Skill in personal Skills library45 min30 secConsistentAcross all Projects
Skill in team Skills library60 min30 secTeam-wideAcross team, ships in agents

If you draft 5+ customer replies a week, the Skill wins from week 2 onwards. If you draft 1 a month, the prompt wins.

The general rule:

  • 1-2 uses per month: prompt
  • 3-10 uses per month: Project with prompt template
  • 10+ uses per month or team use: Skill
  • Inside an Agent: Skill, always

Part 10: What Skills don’t solve

Be honest about limits.

  • Skills don’t replace expertise. A well-written Skill for BAS sanity-checking is useful because YOU know what to put in it. Without your professional knowledge, the Skill is hollow.
  • Skills don’t make Claude smarter. They package what Claude already knows + your specific patterns. They don’t expand the underlying model’s capabilities.
  • Skills don’t auto-update. The voice file inside a Skill goes stale unless you refresh it. Skills need quarterly review.
  • Skills don’t substitute for understanding. If you don’t understand what your Skill does, you can’t debug it when it breaks. Don’t install Skills you can’t read.

For everything else they do, package competence, transfer knowledge across team, compose into agents, version-control institutional knowledge, Skills are the most underused layer of the Claude stack at SMB scale in 2026.

What’s next

Sources cited

  • Anthropic, Claude Code documentation (Skills mechanism + .claude/skills/ structure)
  • Anthropic, Claude Agent SDK documentation (Skills as first-class agent capability)
  • Anthropic, Model Context Protocol specification (Skills + MCP interaction patterns)
  • Tax Practitioners Board, Practice Notes on AI 2025 (for compliance-content references)
  • Australian Consumer Law (Competition and Consumer Act 2010 Sch 2), for the compliance reviewer Skill scope
  • DotVA + On Autopilot internal Skills library across 50+ Australian SMB implementations (anonymised composite)

This piece will be updated as the Anthropic Skills ecosystem evolves. Last updated: 19/05/2026.

Common questions

What's the difference between a Skill, a Project, and an Agent in plain English?
A Project is a folder Claude reads at the start of every chat with that customer / business. It tells Claude WHO this is for. A Skill is a packaged competence Claude invokes when relevant ('draft a BAS sanity check', 'write a social caption in our voice', 'extract data from this invoice'). It tells Claude WHAT it knows how to do well. An Agent is a loop that takes inputs, invokes the right Skills against the right Project context, makes decisions, and produces outputs. It tells Claude HOW to do work in the world. Most operators we audit have Projects set up (good), no Skills (the gap), and either no Agents (fine) or one over-prompted monolithic agent (worse than no agent).
Do I need Claude Code to use Skills?
For local development and personal use, yes. Skills live in `.claude/skills/` in Claude Code's filesystem and are invoked when you're working in a project that has them. For production agents, Skills are part of the Claude Agent SDK and ship with your agent code. For pure-chat Claude.ai users, Skills aren't directly available (yet, mid-2026), but you can recreate the effect with well-structured Project Instructions that include 'invoke this pattern when X'.
Where do Skills come from?
Three sources: (1) you write them, most SMB skills are 5-15 lines of markdown describing a competence, (2) you install them from a community catalogue or marketplace (be cautious; see security considerations below), (3) Claude Code itself can scaffold a skill for you given a description ('build me a SKILL.md for drafting Australian customer replies in my voice'). Most operators we work with write their own; the iteration loop is fast and the privacy posture is cleaner.
How is a Skill different from just a really good prompt?
A Skill is a really good prompt with three additions: (1) it lives in a file and is version-controlled, so changes are tracked, (2) it includes 'when to invoke' triggers so Claude knows when to use it, (3) it can be composed, one Skill can invoke another. A prompt is a one-shot instruction; a Skill is a durable capability. The operational difference shows up at 5+ uses: a Skill compounds, a prompt evaporates.
Can I share Skills with my team?
Yes, that's the main point. Skills are designed to be shared. Recommended pattern: commit Skills to a git repo your team has access to, sync them down via `git pull` to each team member's `.claude/skills/`. The Claude Code plugin mechanism also allows Skills to be packaged and shared as plugins (community catalogues are emerging in 2026 but there is no official Anthropic marketplace at the time of writing). For client work via DotVA, we ship per-client Skill packs that the client owns and we maintain together.
Are Skills safe to install from third parties?
Treat them with the same caution as installing an npm package. A Skill can include executable scripts. A malicious Skill is essentially a malicious package on your machine. The security flagship Part 1.4 covers MCP supply chain risk; the same logic applies to Skills. Trust official Anthropic Skills, well-known publishers, or Skills you've read the source of. Don't trust 'helpful' community Skills uncritically.
What about Skills marketplaces?
Mid-2026 the distribution landscape is still emerging: community-run skill repositories on GitHub, plugins documented in the Claude Code docs, and informal sharing between teams. There is no official Anthropic-run Skills marketplace at the time of writing. For Australian SMB scale, the build-your-own path is almost always better than installing third-party Skills for the same reason it's better to write your own voice file than copy a template: the Skills that work for YOUR business include your specific tone, your specific products, your specific edge cases. Generic Skills don't.
How does this fit with Anthropic's Claude Agent SDK?
Skills are first-class in the Agent SDK. When you build a production agent, you decompose its work into Skills, then write the agent loop to invoke the right Skills against incoming inputs. This is dramatically more maintainable than a monolithic prompt approach. We cover the composition pattern in Part 6 of this piece.

Want this built for your business?

Book a free 30-minute AI audit. We'll map your business and show you exactly which systems we'd build first. No pitch deck, no scoping fee.

Book my free AI audit