category: "Skills"
category_id: 5
source_file: "guide/ultimate-guide.md"

questions:
  - id: "05-001"
    difficulty: "junior"
    profiles: ["junior", "senior", "power", "pm"]
    question: "What is the relationship between Skills and Agents?"
    options:
      a: "Skills replace agents"
      b: "Skills are knowledge packages that agents can inherit"
      c: "Agents are a type of skill"
      d: "They are completely independent"
    correct: "b"
    explanation: |
      Skills are knowledge packages that agents can inherit. While agents are specialized roles (task-focused), skills are reusable knowledge modules (domain-focused). Multiple agents can inherit the same skill, avoiding duplication. For example, both a code-reviewer and security-auditor agent can inherit the security-guardian skill.
    doc_reference:
      file: "guide/ultimate-guide.md"
      section: "5.1 Understanding Skills"
      anchor: "#51-understanding-skills"

  - id: "05-002"
    difficulty: "junior"
    profiles: ["junior", "senior", "power"]
    question: "Where should skill files be stored?"
    options:
      a: ".claude/commands/"
      b: ".claude/skills/{skill-name}/"
      c: ".claude/agents/"
      d: "~/.claude/skills/"
    correct: "b"
    explanation: |
      Skills live in `.claude/skills/{skill-name}/` directories within your project. Each skill has its own folder containing at minimum a SKILL.md file, with optional reference.md, checklists/, examples/, and scripts/ subdirectories. This organization keeps knowledge modular and reusable.
    doc_reference:
      file: "guide/ultimate-guide.md"
      section: "5.2 Creating Skills"
      anchor: "#52-creating-skills"

  - id: "05-003"
    difficulty: "senior"
    profiles: ["senior", "power"]
    question: "What is the REQUIRED file in a skill folder?"
    options:
      a: "README.md"
      b: "skill.yaml"
      c: "SKILL.md"
      d: "index.md"
    correct: "c"
    explanation: |
      SKILL.md is the required main file in every skill folder. Optional files include: reference.md (detailed documentation), checklists/ (verification lists), examples/ (code patterns with good/bad examples), and scripts/ (helper scripts). SKILL.md contains the frontmatter and core instructions for the skill.
    doc_reference:
      file: "guide/ultimate-guide.md"
      section: "5.2 Creating Skills"
      anchor: "#skill-folder-structure"

  - id: "05-004"
    difficulty: "junior"
    profiles: ["junior", "senior", "power"]
    question: "What is the key difference between Skills, Agents, and Commands?"
    options:
      a: "They all do the same thing"
      b: "Skills = knowledge modules (inherited), Agents = specialized roles (delegated), Commands = process workflows (slash invoked)"
      c: "Commands are the only reusable component"
      d: "Agents cannot use skills or commands"
    correct: "b"
    explanation: |
      The three concepts have distinct purposes: Skills are knowledge modules inherited by agents (like OWASP security knowledge), Agents are specialized roles that Claude delegates tasks to (like a security reviewer), and Commands are process workflows invoked with slash commands (like /tech:commit). They can be combined: agents inherit skills and execute commands.
    doc_reference:
      file: "guide/ultimate-guide.md"
      section: "5.1 Understanding Skills"
      anchor: "#skills-vs-agents-vs-commands"

  - id: "05-005"
    difficulty: "senior"
    profiles: ["senior", "power"]
    question: "What does the 'context' field in SKILL.md frontmatter control?"
    options:
      a: "The context window size"
      b: "Whether the skill runs in isolated (fork) or shared (inherit) context"
      c: "The file context to load"
      d: "Database connection context"
    correct: "b"
    explanation: |
      The `context` field controls execution context: 'fork' means isolated context (the skill runs independently), 'inherit' means shared context (the skill shares context with the calling agent). Use fork for skills that need clean state, inherit for skills that need access to conversation history and loaded files.
    doc_reference:
      file: "guide/ultimate-guide.md"
      section: "5.2 Creating Skills"
      anchor: "#skillmd-frontmatter"

  - id: "05-006"
    difficulty: "junior"
    profiles: ["junior", "senior", "power"]
    question: "Why use skills instead of duplicating knowledge in multiple agents?"
    options:
      a: "Skills are faster"
      b: "Skills provide single source of truth - update once, all agents benefit"
      c: "Skills are required by Claude Code"
      d: "Skills cost less"
    correct: "b"
    explanation: |
      Skills follow DRY (Don't Repeat Yourself) principles. Without skills, you'd duplicate security knowledge in Agent A, B, and C. With skills, the security-guardian skill is the single source - all agents inherit it, and updates propagate everywhere. This ensures consistency and simplifies maintenance.
    doc_reference:
      file: "guide/ultimate-guide.md"
      section: "5.1 Understanding Skills"
      anchor: "#why-skills"

  - id: "05-007"
    difficulty: "senior"
    profiles: ["senior", "power"]
    question: "What makes a GOOD skill versus a BAD skill?"
    options:
      a: "Good skills are longer, bad skills are shorter"
      b: "Good skills are reusable, domain-focused, and include reference material; bad skills are single-agent specific and too broad"
      c: "Good skills use opus, bad skills use haiku"
      d: "Good skills have more files"
    correct: "b"
    explanation: |
      Good skills are: reusable across multiple agents, domain-focused (not too broad), contain reference material and checklists, and include verification steps. Bad skills are: specific to only one agent, too broad in scope, just instructions without reference material, and missing verification checklists.
    doc_reference:
      file: "guide/ultimate-guide.md"
      section: "5.1 Understanding Skills"
      anchor: "#what-makes-a-good-skill"

  - id: "05-008"
    difficulty: "power"
    profiles: ["power"]
    question: "What is the TDD (Test-Driven Development) skill's core methodology?"
    options:
      a: "Write tests after code"
      b: "RED (failing test) -> GREEN (minimal code to pass) -> REFACTOR (improve while green)"
      c: "Write all tests first, then all code"
      d: "Skip tests for speed"
    correct: "b"
    explanation: |
      The TDD skill follows: 1) RED - write a failing test for desired behavior BEFORE code, 2) GREEN - write MINIMUM code to make the test pass, 3) REFACTOR - improve implementation while keeping tests green, then repeat. This cycle ensures tests actually verify behavior by requiring failure first, then incremental improvement.
    doc_reference:
      file: "guide/ultimate-guide.md"
      section: "5.4 Skill Examples"
      anchor: "#example-2-tdd-skill"

  - id: "05-009"
    difficulty: "senior"
    profiles: ["senior", "power"]
    question: "What should a Security Guardian skill include for OWASP coverage?"
    options:
      a: "Just a list of vulnerabilities"
      b: "Checklists for each OWASP Top 10 category with specific verification items"
      c: "Links to external security tools"
      d: "Password examples"
    correct: "b"
    explanation: |
      A Security Guardian skill should include detailed checklists for each OWASP Top 10 category: A01 Broken Access Control (check authorization, IDOR, privilege escalation), A02 Cryptographic Failures (hardcoded secrets, TLS, password hashing), A03 Injection (SQL, NoSQL, XSS), etc. Each category should have specific verification items with checkboxes.
    doc_reference:
      file: "guide/ultimate-guide.md"
      section: "5.4 Skill Examples"
      anchor: "#example-1-security-guardian-skill"

  - id: "05-010"
    difficulty: "junior"
    profiles: ["junior", "senior", "power"]
    question: "What is the 'agent' field in SKILL.md frontmatter?"
    options:
      a: "Which agent created the skill"
      b: "Whether the skill is 'specialist' (domain-focused) or 'general' (broad)"
      c: "The agent that must use this skill"
      d: "The agent's name"
    correct: "b"
    explanation: |
      The `agent` field indicates whether the skill is 'specialist' (domain-focused, deep expertise in one area) or 'general' (broad, applicable across domains). Specialist skills like security-guardian provide deep domain knowledge, while general skills might provide widely-applicable patterns or utilities.
    doc_reference:
      file: "guide/ultimate-guide.md"
      section: "5.2 Creating Skills"
      anchor: "#skillmd-frontmatter"

  - id: "05-011"
    difficulty: "power"
    profiles: ["power"]
    question: "What does the 'allowed-tools' field in skill frontmatter control?"
    options:
      a: "Tools the skill documents"
      b: "Tools the skill can use when activated"
      c: "Tools that can activate the skill"
      d: "Tools to install"
    correct: "b"
    explanation: |
      The `allowed-tools` field specifies which tools the skill can use when activated. For example, a security-guardian skill might have `allowed-tools: Read, Grep, Bash` - allowing it to read files, search for patterns, and run security scanning commands, but not modify files. This provides security boundaries for each skill.
    doc_reference:
      file: "guide/ultimate-guide.md"
      section: "5.2 Creating Skills"
      anchor: "#skillmd-frontmatter"

  - id: "05-012"
    difficulty: "senior"
    profiles: ["senior", "power"]
    question: "What optional folders can a skill directory contain?"
    options:
      a: "Only SKILL.md is allowed"
      b: "reference.md, checklists/, examples/, and scripts/"
      c: "src/, dist/, and node_modules/"
      d: "tests/, docs/, and config/"
    correct: "b"
    explanation: |
      A skill directory can contain: SKILL.md (required), reference.md (detailed documentation), checklists/ (verification lists like security.md, performance.md), examples/ (code patterns like good-example.ts, bad-example.ts), and scripts/ (helper scripts like audit.sh). This rich structure supports comprehensive domain knowledge.
    doc_reference:
      file: "guide/ultimate-guide.md"
      section: "5.2 Creating Skills"
      anchor: "#skill-folder-structure"

  - id: "05-013"
    difficulty: "junior"
    profiles: ["junior", "senior", "power"]
    question: "In the Security Guardian skill, what is an example of GOOD password hashing?"
    options:
      a: "md5(password)"
      b: "sha1(password)"
      c: "argon2 or bcrypt"
      d: "Base64 encoding"
    correct: "c"
    explanation: |
      The Security Guardian skill shows argon2 or bcrypt as secure password hashing. BAD examples explicitly listed: md5(password) and sha1(password) - these are cryptographically broken for password storage. Good pattern: `const hashedPassword = await hash(password)` using argon2 library. Always verify password with `await verify(hashedPassword, inputPassword)`.
    doc_reference:
      file: "guide/ultimate-guide.md"
      section: "5.4 Skill Examples"
      anchor: "#authentication-patterns"

  - id: "05-014"
    difficulty: "senior"
    profiles: ["senior", "power"]
    question: "What is the AAA pattern in TDD testing?"
    options:
      a: "Ask, Answer, Assert"
      b: "Arrange, Act, Assert"
      c: "Analyze, Apply, Approve"
      d: "Accept, Adjust, Acknowledge"
    correct: "b"
    explanation: |
      AAA stands for Arrange, Act, Assert: 1) Arrange - set up test data and preconditions, 2) Act - execute the code being tested, 3) Assert - verify the result matches expectations. Example: Arrange items array, Act by calling calculateTotal(items), Assert that total equals expected value. This structure makes tests readable and maintainable.
    doc_reference:
      file: "guide/ultimate-guide.md"
      section: "5.4 Skill Examples"
      anchor: "#test-structure-aaa-pattern"

  - id: "05-015"
    difficulty: "power"
    profiles: ["power"]
    question: "What community skill repository focuses on cybersecurity and penetration testing?"
    options:
      a: "awesome-claude-skills"
      b: "claude-security-pack"
      c: "zebbern/claude-code-guide with 29 cybersecurity skills"
      d: "owasp-claude-skills"
    correct: "c"
    explanation: |
      The zebbern/claude-code-guide repository contains 29 cybersecurity-focused skills covering: penetration testing (SQL injection, XSS, IDOR), security tools (Metasploit, Burp Suite, SQLMap), infrastructure security (AWS, Cloud, Network), and methodologies (ethical hacking, pentest checklists). Important: these should be tested thoroughly and used only with proper authorization.
    doc_reference:
      file: "guide/ultimate-guide.md"
      section: "5.5 Community Skill Repositories"
      anchor: "#cybersecurity-skills-repository"

  - id: "05-016"
    difficulty: "junior"
    profiles: ["junior", "senior", "power"]
    question: "What should skills include to be most useful?"
    options:
      a: "Only theory and concepts"
      b: "Checklists, good/bad code examples, and methodology steps"
      c: "Links to external websites"
      d: "Marketing descriptions"
    correct: "b"
    explanation: |
      Useful skills include: methodology steps (clear process to follow), checklists (verification items with checkboxes), good/bad code examples (showing correct patterns and anti-patterns), and reference material. This combination provides both theoretical knowledge and practical guidance that agents can apply directly to tasks.
    doc_reference:
      file: "guide/ultimate-guide.md"
      section: "5.3 Skill Template"
      anchor: "#53-skill-template"

  - id: "05-017"
    difficulty: "senior"
    profiles: ["senior", "power"]
    question: "How do you reference a skill in an agent's frontmatter?"
    options:
      a: "import: skill-name"
      b: "skills: [skill-name]"
      c: "use: skill-name"
      d: "require: skill-name"
    correct: "b"
    explanation: |
      Reference skills in an agent's frontmatter using the `skills` array: `skills: [security-guardian, tdd]`. This makes the agent inherit all knowledge from those skills. You can reference multiple skills, and the agent combines their expertise. The skill name matches the folder name in `.claude/skills/`.
    doc_reference:
      file: "guide/ultimate-guide.md"
      section: "4.4 Best Practices"
      anchor: "#skill-composition"

  - id: "05-018"
    difficulty: "power"
    profiles: ["power"]
    question: "What disclaimer applies to community cybersecurity skills?"
    options:
      a: "They are officially certified"
      b: "Test thoroughly, ensure authorization, verify against policies, use only legally"
      c: "They work on all systems"
      d: "No disclaimer needed"
    correct: "b"
    explanation: |
      Community cybersecurity skills come with important disclaimers: test thoroughly before using in production assessments, ensure you have proper authorization before penetration testing, review and validate against your organization's security policies, use only in legal contexts with written permission from system owners, and contribute back if you find issues. Verification is essential for any security tooling.
    doc_reference:
      file: "guide/ultimate-guide.md"
      section: "5.5 Community Skill Repositories"
      anchor: "#important-disclaimer"
