Claude Code: Good skills, bad skills

And a curated set used by hundreds of engineers at Fin

Skills are a big part of our 2x journey; they allow us to build specialized capabilities for common tasks. We share these skills across our organization via a private, auto-updating plugin marketplace, created by our dedicated team (“team-2x”). When someone builds a skill to do a task in the best way possible, everyone on the team immediately benefits.

Our mission is to break down all technical work into repeatable, high-quality skills that can be run by Agents to augment our engineering work. Every improvement durably compounds into Agents getting things right in our environment, every time. A classic platform play.

As Darragh wrote in 2× – nine months later, within its first three months, our Claude Code plugins repo had become the most actively contributed-to project at Fin with 153 contributors (31% of R&D) and 267 skills.

After all this shipping, here’s what I’ve noticed separates the best skills from the worst.

Good skills:

• Do one thing really well.

• Are created using a high-quality feedback loop.

• Use scripts for the deterministic parts.

• Have evals that are regularly used and maintained.

• Use progressive discovery to avoid bloating context.

• Have guardrails. Best-effort attempts by Agents that go off-script often result in bad outcomes.

• Are cleaned up after iteration. It’s really common for skills to accumulate cruft over time, such as references to an old way of doing something – this information is usually irrelevant.

• Are regularly refreshed with new learnings. The skill itself can be instructed to do this, or periodic analysis of session data can achieve this.

• Use reference tables and prior learnings – not everything needs to be worked out from first principles every time.

• Use hooks to force skill-use when essential – for example, we never want Agents to query Snowflake without having loaded the domain-specific knowledge required to get queries right the first time.

• Use the correct plugin. Not everybody needs to use every skill, and plugins help get the right skills to the right Agents at the right time.

• Have owners.

• Are devoid of changelogs or references to the old ways of doing things.

• Are unopinionated. In the vast majority of cases, skills should not assume that specific tools or capabilities are available, beyond what is commonly used.

• Are Buzz compatible! (Buzz is our internal remote agent platform.)

Bad skills:

• Get the same things wrong every time.

• Have nobody looking at output.

• …or have non-experts evaluating output.

• Aren’t actually used.

• Are too large for Claude to actually read in one go.

• Can’t easily be invoked by keywords, etc.

• Half-ass the work – create a dashboard for humans to make decisions rather than fully delegating the work to the Agent.

If you’re interested in pointing your Agent at a small, edited, curated set of Claude Code skills/hooks that are heavily used by hundreds of engineers at Fin, we just published some.

Serious use of these will need customization for your environment.

They include:

• skill-tools — Tools for authoring and reviewing Claude Code skills. Includes the

  skill-review skill, which reviews skills against a closed 7-category quality rubric (Structural Discipline, Integrity, Test Coverage, Security, Content Quality, Convention, Cost) with structured JSON output and a determinism contract.

• security-tools — Harden GitHub Actions workflows against supply-chain and injection attacks. Includes the secure-github-actions skill (a 14-rule review checklist plus audit commands) and a hook that auto-loads it when you edit a workflow file.

• claude-code-tools — Meta-tools for running Claude Code well. permissions-analyzer vets your permission allowlist against a GREEN/YELLOW/RED safety model; tool-misses finds and fixes missing CLI tools / BSD-GNU incompatibilities; cc-cost-analysis is a framework for analyzing Claude Code usage costs from OpenTelemetry data.

• test-tools — Investigate and fix flaky tests. The fix-flaky-tests skill detects your framework and CI provider, classifies the flake, and enforces green-CI-as-the-only-verification discipline across RSpec, Jest, pytest, Go test, and more.

• code-review-tools — The thermo-nuclear-code-review skill runs an extremely strict structural and architectural review, hunting for “code judo” simplifications rather than correctness bugs or style nits. Inspired by Cursor’s plugin of the same name.

• pr-tools — Open well-formed GitHub pull requests from Claude Code and attach screenshots and recordings to them. Includes create-pr (intent-gathering, diff validation, public-repo safeguards) and attach-github-assets (upload local images/recordings to GitHub for use in PR and issue markdown).