Skills or Commands and How To Use Them
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
Claude Code offers two extension mechanisms, commands and skills, both stored as version-controlled Markdown files. Commands are explicitly invoked with a slash prefix while skills are automatically triggered by the model when relevant; in recent Claude Code versions, the two have converged, with .claude/skills/ now recommended over .claude/commands/. The piece walks through building custom tools: scoping permissions with allowed-tools, passing arguments, bundling scripts, composing tools together, and forking existing community skills like Matt Pocock's grill-with-docs. It closes with a full example command for automating PR review comment triage using the GitHub CLI.
Table of contents
What is an agent toolSkill vs commandExtending agent toolsExample commandWrapping upFurther readingQuestions this post answers
What is the difference between a command and a skill in Claude Code?
A command is explicitly invoked by typing a slash name like /deploy, running a fixed playbook on demand, while a skill is invoked automatically by the model when it decides the task matches the skill's description. Commands are a single Markdown prompt with frontmatter like allowed-tools; skills are a folder containing SKILL.md plus optional bundled scripts and can carry model-invocation metadata. daily.dev surfaces practical breakdowns like this for developers customizing their Claude Code setup.
Should I put my Claude Code commands in .claude/commands/ or .claude/skills/?
Use .claude/skills/, since it is now the recommended location in recent Claude Code versions, though .claude/commands/ still works. A file at .claude/commands/deploy.md and a skill at .claude/skills/deploy/SKILL.md both produce a usable /deploy command, since both are just Markdown with YAML frontmatter and a command is effectively a skill with the extra features turned off. developers migrating Claude Code setups can track workflow changes like this on daily.dev.
How do I restrict what a Claude Code command is allowed to do in the shell?
Declare exact allowed commands in the frontmatter using the allowed-tools field, for example Bash(gh pr view:*), Bash(gh pr diff:*), Bash(gh api:*), Bash(git branch:*), and Bash(git remote:*). This acts as a guardrail so a tool meant only to read PR data cannot execute destructive actions like a force-push. daily.dev helps developers building safer AI agent tooling keep up with patterns like scoped permissions.