What you will be able to do
- Decide what belongs in a team's CLAUDE.md and what does not
- Turn a repeated prompt into a project skill and share it by committing it
- Use hooks to run deterministic actions on Claude Code events
- Run Claude Code headless and from GitHub Actions to automate workflows
1.CLAUDE.md: context every session starts with
A good prompt helps one developer for one session. To make a workflow repeatable across a team, it has to live in files that Claude Code loads automatically. The first of these is CLAUDE.md, a markdown file of project-specific instructions, conventions and context that Claude reads at the start of every session. /init generates a starter version. Keep it short and practical. It works best for things Claude cannot work out from the code, such as your preferred test runner:
# Code style
- Use ES modules (import/export) syntax, not CommonJS (require)
- Destructure imports when possible (eg. import { foo } from 'bar')
# Workflow
- Be sure to typecheck when you're done making a series of code changes
- Prefer running single tests, and not the whole test suite, for performance| Include | Exclude |
|---|---|
| Code style rules that differ from defaults | Standard language conventions Claude already knows |
| Testing instructions and preferred test runners | Detailed API documentation (link to docs instead) |
| Repository etiquette (branch naming, PR conventions) | Information that changes frequently |
| Developer environment quirks (required env vars) | File-by-file descriptions of the codebase |
| Common gotchas or non-obvious behaviors | Anything Claude can figure out by reading code |
CLAUDE.md can also control what survives context compaction. For example, an instruction to always keep the list of modified files and the test commands means a long session does not lose them.
Checkpoint 1 of 6· Check yourself
A tech lead proposes adding each of these to the team's CLAUDE.md. Which one belongs there?
Environment quirks and testing instructions are on the include list. File-by-file descriptions, detailed API docs and self-evident advice are on the exclude list.
“Testing instructions and preferred test runners”Source: code.claude.com
Checkpoint 2 of 6· Exam question
A security engineer wants Claude Code to review a pull request from an external contributor. Claude should be able to read files and run analysis commands, but the engineer must manually approve every file edit and shell command before it executes. Which permission mode satisfies this requirement?
Correct answer: A — default (Manual) mode, which prompts before any write or command beyond reads
- A. Correct. Manual mode, the default mode, only auto-approves reads and prompts before every edit, write, or shell command, matching the requirement that the engineer approve every action on an untrusted external contribution.
- B. Incorrect. acceptEdits auto-approves file edits and common filesystem Bash commands like mkdir or mv without a prompt, which violates the requirement to manually approve every edit and command.
- C. Incorrect. auto mode routes most actions through a classifier that approves them without a human prompt, which is the opposite of requiring manual approval for every edit and command.
- D. Incorrect. bypassPermissions disables prompts entirely, including for protected paths, so nothing would require the engineer's manual approval.
2.Skills: a team prompt library as files
When a team keeps typing the same multi-step prompt, turn it into a skill. A skill is a SKILL.md file with frontmatter and instructions. Claude can load it when its description matches the task, or you can run it as a slash command. Inside the instructions, $ARGUMENTS is replaced by whatever you type after the command. disable-model-invocation: true means the skill runs only when you invoke it yourself, which suits workflows with side effects such as pushing a PR.
Checkpoint 3 of 6· Fill the gap
This skill turns "/fix-issue 1234" into a full fix workflow. Which placeholder receives the issue number?
---
name: fix-issue
description: Fix a GitHub issue
disable-model-invocation: true
---
Analyze and fix the GitHub issue: ? .$ARGUMENTS holds the text passed after the skill's command. $CLAUDE_PROJECT_DIR and $CLAUDE_ENV_FILE are used in hook commands, not in skill bodies.
Source: code.claude.comWhere you save the skill decides who gets it. A personal skill in ~/.claude/skills/ follows you across your own projects on that machine only. A project skill in .claude/skills/ loads for anyone working in the repository once it is committed. That makes the repository the natural home for a team prompt library. The older .claude/commands/ format still works, but skills are preferred for new work because they can also include supporting files. For delegated reviews, the same idea applies to subagents. The best-practices guide's example is a security-reviewer with a limited set of tools and its own instructions:
---
name: security-reviewer
description: Reviews code for security vulnerabilities
tools: Read, Grep, Glob, Bash
model: opus
---
You are a senior security engineer. Review code for:
- Injection vulnerabilities (SQL, XSS, command injection)
- Authentication and authorization flaws
- Secrets or credentials in code
- Insecure data handlingSources3
3.Hooks: actions that always run
CLAUDE.md and skills are instructions that Claude interprets. Hooks are different: they are shell commands that Claude Code runs automatically at fixed points in its lifecycle, whatever the model decides. Use them for rules that must hold every time, such as formatting each edited file, blocking edits to protected files, or sending a notification when Claude needs input. This hook runs Prettier after every Edit or Write tool call:
{
"hooks": {
"PostToolUse": [
{
"matcher": "Edit|Write",
"hooks": [{ "type": "command", "command": "jq -r '.tool_input.file_path' | xargs npx prettier --write" }]
}
],| Event | When it fires |
|---|---|
| PreToolUse | Before a tool call executes. Can block it |
| PostToolUse | After a tool call succeeds |
| Stop | When Claude finishes responding |
| Notification | When Claude Code sends a notification |
| SessionStart | When a session begins or resumes |
The matcher field limits which tools trigger the hook. A SessionStart hook with the compact matcher can re-inject reminders, such as "use Bun, not npm", after compaction.
Checkpoint 4 of 6· Check yourself
You need to stop Claude from ever writing to .env files, even if a prompt tells it to. Which hook event should run your protection script?
PreToolUse fires before a tool call executes and can block it. PostToolUse fires only after the edit has already succeeded.
“Before a tool call executes. Can block it”Source: code.claude.com
Checkpoint 5 of 6· Exam question
A team wants Claude Code to query their internal PostgreSQL database directly during a session, without the team writing custom tool-execution code themselves. Which approach fits the Model Context Protocol integration model?
Correct answer: A — Configure an MCP server for the database and let Claude discover its tools through the protocol
- A. Correct. MCP servers expose external systems like databases as a set of discoverable tools that Claude can call directly, which is the documented mechanism for connecting Claude to systems such as a PostgreSQL database without hand-writing tool execution code.
- B. Incorrect. Hooks run deterministic shell commands at lifecycle events for validation or logging; they are not designed to serve as the mechanism through which Claude discovers and calls a database's query capabilities.
- C. Incorrect. Granting unrestricted Bash access lets Claude shell out to a CLI client, but this bypasses the structured, discoverable tool interface MCP provides and removes the scoped, auditable tool boundary the team wants.
- D. Incorrect. Putting schema details in a subagent's system prompt gives Claude static knowledge about the database, not a way to actually execute queries against it; it still lacks the live tool connection MCP provides.
Sources4
4.Taking workflows into scripts and CI
The last step is running Claude without anyone at a terminal. The -p flag makes Claude Code scriptable, so you can pipe input in and read output for batch jobs or CI:
git log --oneline -20 | claude -p "summarize these recent commits"For repository events, use the Claude Code GitHub Action. /install-github-app handles setup. It runs in two modes. In interactive mode, the workflow gives no prompt, and Claude waits for an @claude mention in an issue or PR, then replies in a comment. In automation mode, the workflow supplies a prompt, which can be a project skill such as /skill-name, and Claude runs without waiting for a mention. By default, its results go to the workflow run log, not a comment. The code-review plugin posts findings on the PR only when you pass --comment. For recurring jobs, choose by where the work has to run: Routines run in the cloud even when your computer is off, desktop scheduled tasks need local files, GitHub Actions ties into repository events, and /loop polls during an open session.
Checkpoint 6 of 6· Match them up
Match each scheduling option to the job it suits best
Tap a term, then the definition that fits it.
Each option runs in a different place: Anthropic's cloud, your machine through the desktop app, your CI pipeline, or the current CLI session.
“Tasks that should run even when your computer is off.”Source: code.claude.com
Exam traps
Each one states something that sounds right. Open it to see what is actually true.
1.A skill saved in ~/.claude/skills/ is available to everyone on the team.Why is that wrong?
Personal skills load only for your own projects on your own machine. To share a skill, put it in the project's .claude/skills/ and commit it.
Covered in Skills: a team prompt library as files
2.A thorough CLAUDE.md should walk through every file in the codebase.Why is that wrong?
File-by-file descriptions are on the exclude list. Claude can read the code itself, so CLAUDE.md should hold what it cannot work out on its own.
Covered in CLAUDE.md: context every session starts with
3.When the GitHub Action runs with a prompt, Claude posts its results as a PR comment automatically.Why is that wrong?
In automation mode, results go to the workflow run log by default. Claude posts to the issue or PR only if the prompt tells it to and it has a tool that can post.
Covered in Taking workflows into scripts and CI
Practise it for real
Create a personal skill that summarizes your uncommitted changes and flags risks
1.Run: mkdir -p ~/.claude/skills/summarize-changes
Why: Personal skills live in ~/.claude/skills/<skill-name>/ and load in all your projects on this machine
You should see: An empty summarize-changes directory
2.Create SKILL.md in that directory with a description frontmatter, a '## Current changes' heading followed by !
git diff HEAD, and instructions to summarize the diff in two or three bullets and list risksWhy: The description tells Claude when to load the skill, and the !
git diff HEADline puts the live diff into the skill's contentYou should see: A SKILL.md file whose description mentions what changed, commit messages and diff review
3.In a repository with uncommitted edits, start claude and ask: What did I change?
Why: Checks that Claude loads the skill automatically when the request matches its description
You should see: A short bullet summary of your diff followed by any risks, such as missing error handling
4.Run /summarize-changes directly
Why: Checks that the skill also works as an explicit slash command
You should see: The same kind of summary, or a note that there are no uncommitted changes if the diff is empty
Stuck? Get a nudge
If you want teammates to get the skill too, move it to .claude/skills/ in the repository and commit it.
Sources
Every claim above is drawn from one of these pages, quoted as it was written on the date shown.
- 1.
“A markdown file where you store project-specific instructions, conventions, and context that Claude should know every session.”
↩︎ CLAUDE.md: context every session starts with - 2.https://code.claude.com/docs/en/best-practicesOfficial docs
“Customize compaction behavior in CLAUDE.md with instructions like”
↩︎ CLAUDE.md: context every session starts with“File-by-file descriptions of the codebase”
↩︎ Exam trap 2“Testing instructions and preferred test runners”
↩︎ Checkpoint - 3.https://code.claude.com/docs/en/skillsOfficial docs
“Sessions in this repository. Commit it so your team gets it too”
↩︎ Skills: a team prompt library as files“Prefer a skill for new work, since skills also support supporting files.”
↩︎ Skills: a team prompt library as files“Sessions in this repository. Commit it so your team gets it too”
↩︎ Exam trap 1 - 4.https://code.claude.com/docs/en/hooks-guideOfficial docs
“Run shell commands automatically when Claude Code edits files, finishes tasks, or needs input.”
↩︎ Hooks: actions that always run“Before a tool call executes. Can block it”
↩︎ Checkpoint - 5.https://code.claude.com/docs/en/common-workflowsOfficial docs
“Pipe Claude into scripts for CI and batch processing”
↩︎ Taking workflows into scripts and CI“Tasks that should run even when your computer is off.”
↩︎ Checkpoint - 6.https://code.claude.com/docs/en/github-actionsOfficial docs
“By default, results appear in the workflow run log rather than a comment.”
↩︎ Taking workflows into scripts and CI“Without it, Claude posts nothing, and you read the findings in the workflow run log.”
↩︎ Taking workflows into scripts and CI“By default, results appear in the workflow run log rather than a comment.”
↩︎ Exam trap 3