release: v3.20.6 - agentskills.io integration + 4 resource evaluations

- agentskills.io open standard: frontmatter table, skills-ref CLI, portability section - Agent Skills supply chain risks (security-hardening.md §1.2) - anthropics/skills (60K+★) added to complementary resources - 16 new reference.yaml entries - Resource evaluations: agentskills.io (4/5), Skill Doctor (2/5), dclaude (new), paddo (new) - Sandbox isolation + README updates Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-01 16:49:33 +01:00 · 2026-02-01 16:49:33 +01:00 · bc86c8ed7f
commit bc86c8ed7f
parent 23e0ac476d
14 changed files with 625 additions and 26 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@ -4,8 +4,31 @@ All notable changes to this project will be documented in this file.

 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).

+## [3.20.6] - 2026-02-01
+
+### Added
+
+- **agentskills.io Open Standard integration** (scored 4/5) — Agent Skills follow the [agentskills.io](https://agentskills.io) specification, created by Anthropic, supported by 26+ platforms (Cursor, VS Code, GitHub, Codex, Gemini CLI, Goose, Roo Code, etc.)
+  - SKILL.md frontmatter table now distinguishes spec fields (`name`, `description`, `allowed-tools`, `license`, `compatibility`, `metadata`) from Claude Code-only extensions (`context`, `agent`) (`guide/ultimate-guide.md:5180`)
+  - `skills-ref validate` / `skills-ref to-prompt` CLI tool added to skill creation workflow (`guide/ultimate-guide.md:5188`)
+  - Skill Portability section in Goose comparison (`guide/ai-ecosystem.md:1876`)
+  - 16 new reference.yaml entries (spec, CLI, anthropics/skills repo, SafeDep threat model, blog)
+- **Agent Skills Supply Chain Risks** — New section 1.2 in security-hardening.md based on SafeDep threat model (8-14% of public skills have vulnerabilities). 4 mitigations: review SKILL.md, validate with skills-ref, pin versions, audit scripts/ (`guide/security-hardening.md:121`)
+- **anthropics/skills** (60K+⭐) added to README Complementary Resources table
+- **Resource Evaluations**: Skill Doctor GitHub Action (2/5, marginal), agentskills.io specification (4/5, high value) (`docs/resource-evaluations/skill-doctor-github-action.md`, `docs/resource-evaluations/agentskills-io-specification.md`)
+
 ## [Unreleased]

+### Added
+
+- **Fresh Context Pattern**: New "Session-per-Concern Pipeline" variant — dedicates a fresh session to each quality dimension (plan → test → implement → security review → perf → code review) instead of looping the same task. References OpusPlan and TDD. (`guide/ultimate-guide.md:1595`)
+- **Resource Evaluation #19: dclaude** (Patrick Debois) — Dockerized Claude Code wrapper evaluated at 2/5 (Marginal). Fills a narrow gap (Linux + Docker Engine without Docker Desktop) but uses standard containers with host Docker socket mount — weaker isolation than Docker Sandboxes' microVMs. Footnote added in `guide/sandbox-isolation.md` Limitations subsection. (`docs/resource-evaluations/dclaude-docker-wrapper.md`)
+- **Resource Evaluation #20: 10 Tips from Inside the Claude Code Team** (paddo.dev / Boris Cherny thread) — Scored 4/5 (High Value). 4 integrations in ultimate-guide.md:
+  - **Prompting as Provocation** (section 2.6.1): 3 challenge patterns — Gatekeeper, Proof Demand, Reset — treating Claude as a peer to convince rather than an assistant to direct (`guide/ultimate-guide.md:3029`)
+  - **Model-as-Security-Gate** hook pattern: Route permission requests to Opus 4.5 via PreToolUse hook for intelligent security screening beyond static rules (`guide/ultimate-guide.md:6907`)
+  - **Boris Cherny team patterns**: Skills as institutional knowledge (/techdebt, context dumps, BigQuery agents), CLI-over-MCP rationale, re-plan when stuck, Claude writes its own rules (`guide/ultimate-guide.md:11822`)
+  - **Worktree shell aliases**: za/zb/zc navigation + dedicated analysis worktree tip (`guide/ultimate-guide.md:10717`)
+
 ## [3.20.5] - 2026-01-31

 ### Added
--- a/README.md
+++ b/README.md
@ -71,7 +71,7 @@ graph LR
    root --> quiz[🧠 quiz/<br/>257 questions]
    root --> tools[🔧 tools/<br/>utils]
    root --> machine[🤖 machine-readable/<br/>AI index]
-    root --> docs[📚 docs/<br/>25 evaluations]
+    root --> docs[📚 docs/<br/>35 evaluations]

    style root fill:#d35400,stroke:#e67e22,stroke-width:3px,color:#fff
    style guide fill:#2980b9,stroke:#3498db,stroke-width:2px,color:#fff
@ -115,7 +115,7 @@ graph LR
 │  ├─ reference.yaml      Structured index (~2K tokens)
 │  └─ llms.txt            Standard LLM context file
 │
-└─ 📚 docs/               22 Resource Evaluations
+└─ 📚 docs/               35 Resource Evaluations
   └─ resource-evaluations/  5-point scoring, source attribution
 ```

@ -160,7 +160,7 @@ Educational templates with explanations:

 [Browse Catalog →](./examples/)

-### 🔍 22 Resource Evaluations
+### 🔍 35 Resource Evaluations

 Systematic assessment of external resources (5-point scoring):
 - Articles, videos, tools, frameworks
@ -322,6 +322,7 @@ Same agentic capabilities as Claude Code, but through a visual interface with no
 | Project | Focus | Best For |
 |---------|-------|----------|
 | [claude-code-templates](https://github.com/davila7/claude-code-templates) | Distribution (200+ templates) | CLI installation (17k⭐) |
+| [anthropics/skills](https://github.com/anthropics/skills) | Official Anthropic skills (60K+⭐) | Documents, design, dev templates |
 | [skills.sh](https://skills.sh/) | Skills marketplace | One-command install (Vercel Labs) |
 | [awesome-claude-code](https://github.com/hesreallyhim/awesome-claude-code) | Curation | Resource discovery |
 | [AI Coding Agents Matrix](https://coding-agents-matrix.dev) | Technical comparison | Comparing 23+ alternatives |
@ -423,7 +424,7 @@ cd quiz && npm install && npm start
 </details>

 <details>
-<summary><strong>Resource Evaluations</strong> (22 assessments)</summary>
+<summary><strong>Resource Evaluations</strong> (35 assessments)</summary>

 Systematic evaluation of external resources (tools, methodologies, articles) before integration into the guide.

@ -484,7 +485,7 @@ See [CONTRIBUTING.md](./CONTRIBUTING.md) for guidelines.

 ---

-*Version 3.20.5 | January 2026 | Crafted with Claude*
+*Version 3.20.6 | February 2026 | Crafted with Claude*

 <!-- SEO Keywords -->
 <!-- claude code, claude code tutorial, anthropic cli, ai coding assistant, claude code mcp,
--- a/2
+++ b/2
@ -1 +1 @@
-3.20.5
+3.20.6
--- a/docs/resource-evaluations/README.md
+++ b/docs/resource-evaluations/README.md
@ -56,7 +56,9 @@ Les documents de travail bruts (prompts Perplexity, audits clients) restent dans
 | **Worktrunk** | 4/5 | **4/5** | ✅ Intégré (workflow) | [worktrunk-evaluation.md](./worktrunk-evaluation.md) |
 | **Pat Cullen** (Multi-Agent PR Review) | 5/5 | **5/5** | ✅ Intégré (review-pr, code-reviewer, guide) | [017-pat-cullen-final-review.md](./017-pat-cullen-final-review.md) |
 | **Docker Sandboxes** (Isolation Landscape) | 4/5 | **4/5** | ✅ Intégré (guide + notice) | [docker-sandboxes-isolation.md](./docker-sandboxes-isolation.md) |
+| **dclaude** (Dockerized Claude Code) | 2/5 | **2/5** | ⚠️ Footnote (sandbox-isolation.md) | [dclaude-docker-wrapper.md](./dclaude-docker-wrapper.md) |
+| **10 Tips from Inside the Claude Code Team** (paddo.dev) | 4/5 | **4/5** | ✅ Intégré (4 sections) | [paddo-team-tips-eval.md](./paddo-team-tips-eval.md) |

 ---

-**Dernier update**: 2026-01-31 (18 évaluations)
+**Dernier update**: 2026-02-01 (20 évaluations)
--- a/docs/resource-evaluations/agentskills-io-specification.md
+++ b/docs/resource-evaluations/agentskills-io-specification.md
@ -0,0 +1,150 @@
+# Evaluation: agentskills.io - Agent Skills Open Specification
+
+**Date**: 2026-02-01
+**Source**: [agentskills.io](https://agentskills.io/home) | [GitHub: agentskills/agentskills](https://github.com/agentskills/agentskills) (8.2K stars) | [GitHub: anthropics/skills](https://github.com/anthropics/skills) (60.1K stars)
+**Maintainer**: Anthropic (open development, community contributions)
+**Type**: Open specification + reference implementation + official skill library
+**License**: Apache 2.0 (spec + open skills), Source-available (document skills)
+
+---
+
+## Resume du contenu
+
+- **Specification formelle** pour Agent Skills: format SKILL.md, YAML frontmatter, naming rules, directory structure, progressive disclosure model
+- **26+ plateformes supportees**: Claude Code, Claude.ai, GitHub, Cursor, VS Code, OpenAI Codex, Gemini CLI, Goose, Roo Code, Amp, Spring AI, Databricks, Factory, Mistral Vibe, TRAE, Firebender, Letta, et plus
+- **anthropics/skills** (60.1K stars): repo officiel Anthropic avec skills d'exemple (documents DOCX/PDF/PPTX/XLSX, creative, dev, enterprise) + integration plugin Claude Code
+- **skills-ref CLI**: outil officiel de validation et generation de prompt XML (`skills-ref validate`, `skills-ref to-prompt`)
+- **Guide d'integration**: documentation pour ajouter le support skills dans n'importe quel agent (filesystem-based ou tool-based)
+
+## Score de pertinence: 4/5
+
+**Justification**:
+
+1. **Gap majeur confirme**: Le guide documente les skills comme une feature Claude Code sans mentionner que c'est un **standard ouvert cross-plateforme** maintenu par Anthropic. C'est une omission significative pour un guide qui se veut reference.
+2. **60.1K stars**: `anthropics/skills` est le repo Anthropic le plus starre. Le guide le mentionne en passant (`npx add-skill anthropics/skills` sur 2 lignes) sans documenter son contenu ni son ampleur.
+3. **agentskills.io absent**: La specification formelle (naming rules, progressive disclosure, integration guide) n'apparait nulle part dans le guide. Pourtant c'est la source de verite de la feature que le guide documente.
+4. **Interoperabilite = argument de poids**: Dire a un utilisateur "vos skills Claude Code fonctionnent aussi dans Cursor, VS Code, Codex, Gemini CLI" est une info a haute valeur ajoutee.
+5. **Pas un 5/5 car**: Le guide documente deja bien les skills pour l'usage Claude Code quotidien. L'utilisateur typique n'a pas besoin de la spec formelle pour utiliser des skills. Le gap est conceptuel (manque de contexte) plus que pratique (manque de how-to).
+
+## Comparatif
+
+| Aspect | agentskills.io | Notre guide |
+|--------|---------------|-------------|
+| Spec SKILL.md formelle | Source de verite (naming rules, constraints precises) | Documentation Claude Code-specific (moins precise) |
+| Cross-platform (26+ outils) | Documente + logo carousel | Absent |
+| Progressive disclosure model | Documente formellement (3 niveaux) | Mentionne implicitement (quiz) |
+| `name` constraints | 1-64 chars, lowercase, no `--`, must match dir | "Kebab-case identifier" (vague) |
+| `description` constraints | Max 1024 chars, keywords pour matching | "Activation trigger" (vague) |
+| `license` field | Documente | Absent |
+| `compatibility` field | Documente (max 500 chars) | Absent |
+| `metadata` field | Documente (key-value) | Absent |
+| `context` field (fork/inherit) | Absent (Claude Code-specific) | Documente |
+| `agent` field (specialist/general) | Absent (Claude Code-specific) | Documente |
+| skills-ref CLI (validation) | Outil officiel | Absent |
+| `<available_skills>` XML format | Documente (pour integration) | Absent |
+| anthropics/skills repo | 60.1K stars, skills officiels | 2 lignes (`npx add-skill`) |
+| Security (sandboxing, allowlist) | Section dediee | Mentionne dans validation checklist |
+| Integration guide (pour devs) | Guide complet (filesystem vs tool-based) | Hors scope (guide utilisateur) |
+| Directory structure | `scripts/`, `references/`, `assets/` | `scripts/`, `reference.md`, `checklists/`, `examples/` |
+
+**Observation critique**: Le guide documente 2 champs (`context`, `agent`) qui ne sont PAS dans la spec officielle agentskills.io. Ce sont des extensions Claude Code-specifiques. Cela devrait etre clarifie pour eviter la confusion.
+
+## Recommandations
+
+**Action: Integrer (priorite haute).**
+
+### 1. Ajout d'un bloc "Open Standard" dans Section 5
+
+**Ou**: `guide/ultimate-guide.md` apres ligne ~5133 (apres la structure de dossier)
+
+**Quoi**: Bloc de 15-20 lignes expliquant:
+- Agent Skills = standard ouvert (agentskills.io), cree par Anthropic
+- 26+ plateformes supportees (les skills sont portables)
+- Claude Code implemente la spec + ajoute des extensions (`context`, `agent`)
+- Lien vers spec formelle pour reference
+
+### 2. Clarification des champs frontmatter
+
+**Ou**: `guide/ultimate-guide.md` ligne ~5146 (tableau des champs)
+
+**Quoi**:
+- Distinguer champs spec officielle (`name`, `description`, `allowed-tools`, `license`, `compatibility`, `metadata`) des extensions Claude Code (`context`, `agent`)
+- Ajouter les contraintes precises du `name` (1-64 chars, pas de `--`, doit matcher le repertoire)
+- Ajouter `license`, `compatibility`, `metadata` dans le tableau
+
+### 3. Reference anthropics/skills
+
+**Ou**: `guide/ultimate-guide.md` section Skills Marketplace (~ligne 5873)
+
+**Quoi**:
+- Mention du repo officiel (60.1K stars) avec les categories de skills
+- Plugin install: `/plugin marketplace add anthropics/skills`
+- Distinction: skills open source (Apache 2.0) vs document skills (source-available)
+
+### 4. skills-ref dans reference.yaml
+
+**Ou**: `machine-readable/reference.yaml`
+
+**Quoi**: Ajouter entrees pour agentskills.io, anthropics/skills, skills-ref
+
+### 5. Mention progressive disclosure
+
+**Ou**: Existant implicitement, a rendre explicite dans Section 5.1 ou 5.2
+
+**Quoi**: 3 lignes sur le modele metadata-only → full SKILL.md → resources on demand
+
+## Challenge (auto-critique)
+
+### Arguments pour score +1 (5/5):
+- Le guide pretend etre LA reference Claude Code. Ne pas mentionner la spec officielle d'une feature couverte sur 800+ lignes est un trou embarrassant.
+- 60.1K stars = ce n'est pas un projet de niche. C'est le repo Anthropic le plus populaire.
+- L'interoperabilite (skills portables entre 26+ outils) est un argument selling point majeur que le guide rate completement.
+- Les champs `context` et `agent` documentes dans le guide ne sont PAS dans la spec officielle - potentielle source de confusion pour les lecteurs.
+
+### Arguments pour score -1 (3/5):
+- L'utilisateur Claude Code moyen ne se soucie pas de la spec formelle. Il veut creer un skill qui marche.
+- Le guide documente deja bien le workflow pratique.
+- agentskills.io est une spec pour les implementeurs d'agents, pas pour les utilisateurs finaux.
+- Les 60.1K stars de anthropics/skills sont gonfles par le buzz initial - beaucoup de stargazers passifs.
+
+### Verdict du challenge:
+Score 4/5 maintenu. L'argument "spec pour implementeurs" est valide mais le guide documente deja l'architecture interne (guide/architecture.md), les hooks, le MCP protocol - il ne se limite pas au "how-to utilisateur". L'absence de la spec officielle est un gap reel, pas critique pour l'usage quotidien mais significatif pour la completude. L'interoperabilite et anthropics/skills meritent clairement une mention.
+
+### Points manques:
+- Le **threat model SafeDep** (safedep.io/agent-skills-threat-model) documente des vulnerabilites dans la spec (8-14% des skills). Angle securite pertinent pour `guide/security-hardening.md`.
+- Le blog Anthropic ["Equipping Agents for the Real World"](https://anthropic.com/engineering/equipping-agents-for-the-real-world-with-agent-skills) est la source primaire a referencer.
+- Claude.ai supporte aussi les skills directement (pas juste Claude Code) - angle cowork potentiel.
+
+### Risques de non-integration:
+**Moderes.** Un lecteur decouvrant la spec agentskills.io realiserait que le guide decrit les skills comme une feature Claude Code isolee, alors qu'elles sont cross-plateforme. Perte de credibilite sur la completude.
+
+## Fact-Check
+
+| Affirmation | Verifiee | Source |
+|-------------|----------|--------|
+| 26+ plateformes (logo carousel) | ✅ | agentskills.io/home (26 logos comptes) |
+| 8.2K stars agentskills/agentskills | ✅ | GitHub repo |
+| 60.1K stars anthropics/skills | ✅ | GitHub repo |
+| Cree par Anthropic | ✅ | agentskills.io ("originally developed by Anthropic") |
+| Standard ouvert | ✅ | agentskills.io ("released as an open standard") |
+| skills-ref CLI existe | ✅ | GitHub (agentskills/agentskills/skills-ref/) |
+| `name` max 64 chars, lowercase | ✅ | agentskills.io/specification |
+| `description` max 1024 chars | ✅ | agentskills.io/specification |
+| Progressive disclosure 3 niveaux | ✅ | agentskills.io/what-are-skills |
+| Claude Code dans les plateformes | ✅ | Logo carousel sur home page |
+| `context`/`agent` absents de la spec | ✅ | agentskills.io/specification (non mentionnes) |
+| Document skills = source-available | ✅ | anthropics/skills README |
+| Plugin install disponible | ✅ | anthropics/skills README |
+| SafeDep threat model | ✅ | Perplexity (safedep.io, jan 2026) |
+| Anthropic blog post | ✅ | anthropics/skills README (lien) |
+
+**Corrections apportees**: Aucune. Toutes les claims verifiees.
+
+## Decision finale
+
+- **Score final**: 4/5
+- **Action**: Integrer (priorite haute, dans la semaine)
+- **Confiance**: Haute
+- **Scope d'integration**: 5 modifications ciblees (section open standard, frontmatter, anthropics/skills, reference.yaml, progressive disclosure)
+- **Effort estime**: Section additionnelle de ~50-80 lignes dans ultimate-guide.md + mises a jour reference.yaml
+- **Note**: Cette evaluation rend le gap encore plus visible - le guide traite les skills sur 800+ lignes sans jamais mentionner la spec officielle qui les definit
--- a/docs/resource-evaluations/dclaude-docker-wrapper.md
+++ b/docs/resource-evaluations/dclaude-docker-wrapper.md
@ -0,0 +1,73 @@
+# Resource Evaluation: dclaude — Dockerized Claude Code Wrapper
+
+| Field | Value |
+|-------|-------|
+| **Resource** | [github.com/jedi4ever/dclaude](https://github.com/jedi4ever/dclaude) + [LinkedIn post](https://www.linkedin.com/posts/patrickdebois_github-jedi4everdclaude-activity-7423577213188562944-jUE_) |
+| **Type** | Open-source tool (bash script) |
+| **Author** | Patrick Debois ("father of DevOps", creator of DevOpsDays 2009, co-author DevOps Handbook) |
+| **Published** | 2026-02-01 |
+| **Score** | **2/5** (Marginal) |
+| **Action** | Footnote in `guide/sandbox-isolation.md` (Limitations subsection) |
+
+---
+
+## Summary
+
+1. **dclaude** is a single-file bash script wrapping Claude Code CLI inside a standard Docker container for filesystem isolation. Drop-in replacement: all Claude CLI flags forwarded.
+2. **Primary motivation**: Claude Code can navigate entire filesystems, including other git worktree branches, risking accidental edits to production code. dclaude restricts visibility to mounted directories only.
+3. **Features**: SSH agent forwarding, GPG signing, Docker-in-Docker (via host socket), automatic port mapping with URL rewriting, persistent named containers, GitHub token forwarding, `.env` auto-loading.
+4. **Installation**: Single `curl` download, auto-builds Docker image on first run. Requires Docker Engine only (no Docker Desktop).
+5. **Security model**: Standard container isolation (not microVM). Mounts host Docker socket (`/var/run/docker.sock`), `~/.ssh`, `~/.gnupg` into container — expands attack surface vs. Docker Sandboxes' private daemon approach.
+
+## Gap Analysis
+
+| Topic | Guide status | dclaude adds |
+|-------|-------------|--------------|
+| Sandbox isolation | ✅ Comprehensive (`sandbox-isolation.md`, 6 solutions) | Nothing new |
+| Linux + Docker Engine | ⚠️ Gap documented (line 224) but no workaround | ✅ Fills gap |
+| Worktree isolation use case | ❌ Not explicitly motivated | ✅ Explicit motivation |
+| SSH/GPG forwarding in sandbox | ❌ Not covered | ✅ Built-in (but ⚠️ security tradeoff) |
+
+## Score Justification
+
+**2/5 (Marginal)** because:
+
+- The guide already covers Docker Sandboxes (official, microVM isolation) plus 5 alternatives — no material gap
+- dclaude uses standard containers, not microVMs — weaker isolation than Docker Sandboxes. The guide's own anti-patterns (line 377) warn: "Assuming containers = VMs"
+- Host Docker socket mount means containerized Claude can control the host Docker daemon — opposite of Docker Sandboxes' private daemon
+- Single-maintainer bash script with no lifecycle guarantees
+- However: works on Linux with Docker Engine (real gap), and Patrick Debois's standing in the DevOps community gives credibility
+
+**Why not 3/5**: Weaker security model and narrow differentiator (Linux-only gap) don't warrant a dedicated section. The guide documents the Linux limitation already.
+
+**Why not 1/5**: Fills a legitimate gap for Linux Docker Engine users. Debois's contribution merits acknowledgment.
+
+## Challenge (technical-writer)
+
+The technical-writer agent confirmed the 2/5 score with additional analysis:
+
+- **Security under-analyzed**: Host Docker socket mount is a material concern, not just "weaker isolation"
+- **Debois credibility understated**: He coined "DevOps" — not just "a known figure"
+- **Drop-in claim unverified**: Edge cases (MCP servers, `--resume`, session persistence) likely have friction
+- **Placement recommendation refined**: Footnote in Limitations subsection (line 225), NOT in comparison matrix
+- **Risk of non-integration**: Minimal — no reader fails to find a sandbox solution without dclaude
+
+## Fact-Check
+
+| Claim | Status | Source |
+|-------|--------|--------|
+| Author: Patrick Debois | ✅ | LinkedIn profile (17.5K followers) |
+| Debois = "father of DevOps" | ✅ | Multiple sources (New Relic, DEV Community, jedi.be) |
+| GitHub: jedi4ever | ✅ | Matches jedi.be domain |
+| Drop-in replacement for claude CLI | ⚠️ | Claimed by README, not independently tested |
+| Single-file install via curl | ✅ | GitHub README |
+| SSH/GPG/Docker-in-Docker support | ✅ | GitHub README |
+| Auto-builds Docker image | ✅ | GitHub README |
+| Persistent container mode | ✅ | GitHub README |
+| 60 likes, 7 comments (LinkedIn) | ✅ | LinkedIn post (snapshot at fetch time) |
+
+## Integration Applied
+
+- `guide/sandbox-isolation.md` line 225 — Footnote mention in Limitations subsection with security tradeoff note
+- `docs/resource-evaluations/dclaude-docker-wrapper.md` — This file
+- `docs/resource-evaluations/README.md` — Index entry added
--- a/docs/resource-evaluations/paddo-team-tips-eval.md
+++ b/docs/resource-evaluations/paddo-team-tips-eval.md
@ -0,0 +1,91 @@
+# Resource Evaluation: 10 Tips from Inside the Claude Code Team
+
+**Date**: 2026-02-01
+**Evaluator**: Claude (Opus 4.5)
+**Status**: Integrated (4 sections in ultimate-guide.md)
+
+---
+
+## Resource Details
+
+**Source**: Blog post (thread synthesis)
+**URL**: https://paddo.dev/blog/claude-code-team-tips/
+**Title**: "10 Tips from Inside the Claude Code Team"
+**Author**: paddo.dev (synthesis of Boris Cherny thread)
+**Original thread**: x.com/bcherny/status/2017742741636321619
+**Date**: February 2026
+
+**Content type**: Practitioner tips from the Claude Code team at Anthropic (10 patterns)
+
+---
+
+## Summary
+
+Synthesis of 10 tips from the Claude Code team (Boris Cherny and colleagues at Anthropic). Covers parallelization, re-planning, self-improving rules, skills as institutional knowledge, bug-fixing workflows, prompting philosophy, terminal setup, subagent patterns, database skills, and learning workflows.
+
+---
+
+## Evaluation Score: 4/5
+
+**Rating**: High Value — 3 novel patterns + complements to existing sections
+
+### Justification
+
+**Strengths**:
+- Primary authoritative source (the actual Claude Code team at Anthropic)
+- 3 genuinely novel patterns not covered in guide:
+  1. **Prompting as Provocation** — challenge-based prompting philosophy with concrete patterns
+  2. **Model-as-Security-Gate** — using Opus as hook-based permission screener
+  3. **Shell aliases for worktrees** — practical navigation optimization
+- Enriches existing Boris Cherny case study with broader team context
+- Concrete, actionable examples (not abstract advice)
+
+**Weaknesses**:
+- Significant overlap with existing content (~50%):
+  - Parallelization via worktrees: already covered extensively
+  - CLAUDE.md as compounding memory: already documented in Boris case study
+  - Skills system: already documented (though team examples add value)
+  - Re-plan when stuck: Plan Mode already covered
+- Blog post is a synthesis, not primary source (original is a Twitter thread)
+- Some tips lack implementation detail (e.g., Opus security gate is conceptual)
+
+### Gap Analysis
+
+| Tip | Status in Guide | Action |
+|-----|----------------|--------|
+| 1. Parallelization (worktrees) | Already covered (section 10.3) | No action |
+| 2. Re-plan when stuck | Plan Mode covered (section 2.4) | Added to team patterns |
+| 3. Claude writes its own rules | CLAUDE.md covered (section 3.2) | Added to team patterns |
+| 4. Skills as institutional knowledge | Skills covered (section 5.3) | Added team examples |
+| 5. Claude fixes its own bugs | Debugging covered (section 9.1) | No action |
+| 6. Prompting as Provocation | **NEW** — not in guide | **Integrated** as section 2.6.1 |
+| 7. Terminal setup | Partially covered (Ghostty, statusline) | No action (marginal) |
+| 8. Subagents / Security gate | **NEW** — model-as-gate pattern | **Integrated** in hooks section |
+| 9. Claude replaces SQL | **NEW detail** — BigQuery skill example | Added to team patterns |
+| 10. Learning with Claude | Learning guide exists | No action |
+
+### Fact-Check
+
+- Boris Cherny is confirmed creator of Claude Code (verified in existing case study)
+- Thread is from verified @bcherny account
+- Patterns are consistent with Claude Code capabilities (hooks, skills, worktrees)
+- Opus-as-gate pattern is conceptual but technically feasible with current hook system
+- No invented metrics or unverifiable claims
+
+---
+
+## Integration Decision
+
+**Score**: 4/5 — Integrate within 1 week
+
+**Integrated as**:
+1. New section `### 2.6.1 Prompting as Provocation` (~30 lines) — after XML Prompting
+2. New section `### Advanced Pattern: Model-as-Security-Gate` (~25 lines) — after Testing Security Hooks
+3. Enriched Boris Cherny case study with "Team patterns" block (~18 lines)
+4. Shell aliases tip in worktrees section (~12 lines)
+
+**Not integrated** (already covered or marginal):
+- Parallelization tips (extensive existing coverage)
+- Terminal setup details (Ghostty already mentioned)
+- Bug-fixing workflow (debugging section sufficient)
+- Learning patterns (learning guide exists)
--- a/docs/resource-evaluations/skill-doctor-github-action.md
+++ b/docs/resource-evaluations/skill-doctor-github-action.md
@ -0,0 +1,98 @@
+# Evaluation: Skill Doctor (GitHub Action)
+
+**Date**: 2026-02-01
+**Source**: [github.com/tcarac/skill-doctor](https://github.com/tcarac/skill-doctor) | [LinkedIn post](https://www.linkedin.com/posts/tomascaraccia_github-tcaracskill-doctor-a-github-activity-7422266051263995904-Ue60)
+**Author**: Tomas Caraccia
+**Type**: Open-source tool (GitHub Action)
+**License**: Apache 2.0
+
+---
+
+## Résumé du contenu
+
+- GitHub Action qui valide les Agent Skills contre la spécification officielle agentskills.io
+- Vérifie: YAML frontmatter, naming conventions (lowercase, 1-64 chars), description (non-vide, max 1024), structure de fichiers, champs inattendus
+- Intégration PR: commentaires détaillés + annotations inline + suggestions auto-fix
+- Modes: skill unique, multiple skills, ou fichiers modifiés uniquement (optimisé CI)
+- Stack: Python 3.11+, uv, pytest, Docker, Apache 2.0
+
+## Score de pertinence: 2/5
+
+**Justification**:
+
+1. **Adoption quasi-nulle**: 3 stars, 0 forks, 17 commits, repo créé le 28 janvier 2026 (4 jours). Post LinkedIn: 8 likes, 0 commentaires. Aucune validation communautaire.
+2. **Guide déjà exhaustif sur la structure SKILL.md**: Le guide documente extensivement le frontmatter, la structure de fichiers, les bonnes pratiques (lignes 4420-5950+ du ultimate-guide.md), incluant des quiz de validation (19 questions).
+3. **agentskills.io n'est pas documenté dans le guide**: La spécification formelle n'apparaît nulle part, mais c'est un choix délibéré - le guide documente la spec Claude Code native, pas une spec tierce.
+4. **Concept valide, outil immature**: L'idée de CI/CD pour skills est pertinente, mais l'outil est trop jeune pour être recommandé.
+5. **Engagement LinkedIn minimal**: 8 likes sur un réseau de plusieurs millions d'utilisateurs techniques = signal de niche.
+
+## Comparatif
+
+| Aspect | Skill Doctor | Notre guide |
+|--------|-------------|-------------|
+| Structure SKILL.md | Validation automatisée | Documentation détaillée (spec + exemples) |
+| Frontmatter YAML | Check programmatique | Documentation + quiz interactif |
+| Bonnes pratiques naming | Enforcement via CI | Guidelines documentées |
+| Spécification agentskills.io | Référence centrale | Non mentionnée (spec Claude Code native) |
+| CI/CD pour skills | GitHub Action clé-en-main | Non couvert |
+| Auto-fix suggestions | Oui (PR comments) | Non applicable |
+| Maturité | 3 stars, 4 jours | 3.20.5, 11K+ lignes |
+
+## Recommandations
+
+**Action: Ne pas intégrer.**
+
+L'outil est trop immature pour justifier une mention. Réévaluer si:
+- Le repo atteint 100+ stars (signal d'adoption réelle)
+- agentskills.io devient un standard reconnu au-delà des articles de blog
+- D'autres outils de validation émergent (signal d'un besoin marché)
+
+**Alternative possible** (si croissance future): Mention dans la section Skills Marketplace (ultimate-guide.md:5873) comme outil QA complémentaire.
+
+## Challenge (auto-critique)
+
+### Arguments pour score +1 (3/5):
+- **Gap réel**: Le guide ne couvre PAS le CI/CD pour skills. Aucune section ne traite de "comment valider automatiquement ses skills en CI". C'est un pattern DevOps pertinent.
+- **Spec agentskills.io absente**: La recherche Perplexity confirme que cette spec est adoptée par Spring AI, AWS Strands, et d'autres. Ne pas la mentionner est un trou.
+- **Premier outil du genre**: Skill Doctor est (à date) le seul linter de skills public. Premier-mover dans une niche = potentiellement important plus tard.
+
+### Arguments pour score -1 (1/5):
+- **4 jours d'existence**: Impossible de juger la qualité ou la pérennité. Le repo pourrait être abandonné dans 2 semaines.
+- **Spec non-Anthropic**: agentskills.io n'est pas maintenu par Anthropic. Claude Code a sa propre spec de skills. Documenter une spec tierce crée de la confusion.
+- **Self-promotion pure**: Le post LinkedIn est de l'auteur lui-même. Zéro validation externe.
+
+### Verdict du challenge:
+Le score 2/5 tient. Le gap CI/CD pour skills est réel mais ne justifie pas d'intégrer un outil de 4 jours avec 3 stars. Le gap agentskills.io mérite une note dans la watchlist mais pas une documentation à ce stade.
+
+### Points manqués:
+- La spec agentskills.io gagne en traction (Spring AI, AWS Strands) - à surveiller indépendamment de cet outil
+- Le threat model de SafeDep (safedep.io/agent-skills-threat-model) identifie des vulnérabilités dans la spec - angle sécurité potentiellement intéressant pour le guide
+
+### Risques de non-intégration:
+**Faibles.** Si l'outil explose en popularité, on l'intègre plus tard. Le guide ne perd rien à attendre. Le pattern "attendre l'adoption" a été validé pour d'autres évaluations (Remotion: score 2/5, même logique).
+
+## Fact-Check
+
+| Affirmation | Vérifiée | Source |
+|-------------|----------|--------|
+| 3 stars GitHub | ✅ | GitHub repo (vérifié 2x) |
+| 0 forks | ✅ | GitHub repo |
+| 17 commits | ✅ | GitHub repo |
+| Apache 2.0 license | ✅ | GitHub repo |
+| Repo créé 28 jan 2026 | ✅ | GitHub repo |
+| Python 3.11+ | ✅ | GitHub repo |
+| 8 likes LinkedIn | ✅ | LinkedIn post |
+| 0 comments LinkedIn | ✅ | LinkedIn post |
+| agentskills.io = spec formelle | ✅ | Perplexity (Spring AI, AWS Strands, rushis.com) |
+| Spec adoptée multi-plateforme | ✅ | Perplexity (Spring AI, AWS Strands, Medium articles) |
+| Threat model exists (SafeDep) | ✅ | Perplexity (safedep.io, jan 2026) |
+
+**Corrections apportées**: Aucune. Toutes les claims vérifiées.
+
+## Décision finale
+
+- **Score final**: 2/5
+- **Action**: Ne pas intégrer
+- **Confiance**: Haute
+- **Watchlist**: Oui - réévaluer si adoption > 100 stars ou si agentskills.io devient standard Anthropic
+- **Note**: La spec agentskills.io elle-même (indépendamment de cet outil) mérite une évaluation séparée si elle continue à gagner en traction
--- a/guide/ai-ecosystem.md
+++ b/guide/ai-ecosystem.md
@ -1873,6 +1873,10 @@ An **on-machine AI coding agent** developed by Block (formerly Square), released
 - You value Claude's specific reasoning capabilities and can't substitute
 - You don't want to manage LLM API credentials

+### Skill Portability
+
+Both Claude Code and Goose support the [Agent Skills open standard](https://agentskills.io) (agentskills.io). Skills you create with SKILL.md are portable across 26+ platforms including Cursor, VS Code, GitHub, OpenAI Codex, and Gemini CLI. Claude Code-specific fields (`context`, `agent`) are ignored by other platforms but don't break compatibility.
+
 ### Trade-offs

 | Goose Advantage | Goose Limitation |
--- a/guide/cheatsheet.md
+++ b/guide/cheatsheet.md
@ -6,7 +6,7 @@

 **Written with**: Claude (Anthropic)

-**Version**: 3.20.5 | **Last Updated**: January 2026
+**Version**: 3.20.6 | **Last Updated**: January 2026

 ---

@ -484,4 +484,4 @@ where.exe claude; claude doctor; claude mcp list

 **Author**: Florian BRUNIAUX | [@Méthode Aristote](https://methode-aristote.fr) | Written with Claude

-*Last updated: January 2026 | Version 3.20.5*
+*Last updated: January 2026 | Version 3.20.6*
--- a/guide/sandbox-isolation.md
+++ b/guide/sandbox-isolation.md
@ -222,7 +222,7 @@ Triggered automatically if no credentials found. Use `/login` inside Claude Code
 ### Limitations

 - **macOS and Windows only** for microVM mode. Linux uses legacy container-based sandboxes (Docker Desktop 4.57+).
- **Docker Desktop required** — not available with standalone Docker Engine.
+- **Docker Desktop required** — not available with standalone Docker Engine. Community alternatives like [dclaude](https://github.com/jedi4ever/dclaude) (Patrick Debois) wrap Claude Code in standard Docker containers for Docker Engine-only environments, but use container isolation (not microVM) and mount the host Docker socket — weaker security boundary.
 - **MCP Gateway not yet supported** inside sandboxes.
 - **No GPU passthrough** — not suitable for ML training workloads.
 - **Workspace sync is one-way**: changes inside the sandbox propagate to the host, but concurrent host edits may conflict.
--- a/guide/security-hardening.md
+++ b/guide/security-hardening.md
@ -118,7 +118,17 @@ Before adding any MCP server, complete this checklist:
 - Use read-only database credentials
 - Minimize environment variables exposed

-### 1.2 Known Limitations of permissions.deny
+### 1.2 Agent Skills Supply Chain Risks
+
+Third-party Agent Skills (installed via `npx add-skill` or plugin marketplaces) introduce supply chain risks similar to npm packages. Research by [SafeDep](https://safedep.io/agent-skills-threat-model) identified vulnerabilities in **8-14% of publicly available skills**, including prompt injection, data exfiltration, and privilege escalation.
+
+**Mitigations**:
+- **Review SKILL.md before installing** — Check `allowed-tools` for unexpected access (especially `Bash`)
+- **Validate with skills-ref** — `skills-ref validate ./skill-dir` checks spec compliance ([agentskills.io](https://agentskills.io))
+- **Pin skill versions** — Use specific commit hashes when installing from GitHub
+- **Audit scripts/** — Executable scripts bundled with skills are the highest-risk component
+
+### 1.3 Known Limitations of permissions.deny

 The `permissions.deny` setting in `.claude/settings.json` is the official method to block Claude from accessing sensitive files. However, security researchers have documented architectural limitations.

@ -176,7 +186,7 @@ Because `permissions.deny` alone cannot guarantee complete protection:

 > **Bottom line**: `permissions.deny` is necessary but not sufficient. Treat it as one layer in a defense-in-depth strategy, not a complete solution.

-### 1.3 Repository Pre-Scan
+### 1.4 Repository Pre-Scan

 Before opening untrusted repositories, scan for injection vectors:

--- a/guide/ultimate-guide.md
+++ b/guide/ultimate-guide.md
@ -10,7 +10,7 @@

 **Last updated**: January 2026

-**Version**: 3.20.5
+**Version**: 3.20.6

 ---

@ -1593,6 +1593,18 @@ while :; do cat TASK.md PROGRESS.md | claude -p ; done
 - Design without clear spec
 - Tasks with slow/ambiguous feedback loops

+**Variant: Session-per-Concern Pipeline**
+
+Instead of looping the same task, dedicate a fresh session to each quality dimension:
+
+1. **Plan session** — Architecture, scope, acceptance criteria
+2. **Test session** — Write unit, integration, and E2E tests first (TDD)
+3. **Implement session** — Code until all linters and tests pass
+4. **Review sessions** — Separate sessions for security audit, performance, code review
+5. **Repeat** — Iterate with scope adjustments as needed
+
+This combines Fresh Context (clean 200K per phase) with [OpusPlan](#62-opusplan-hybrid-mode) (Opus for review/strategy sessions, Sonnet for implementation). Each session generates progress artifacts that feed the next.
+
 #### Practical Implementation

 **Option 1: Manual loop**
@ -3014,6 +3026,40 @@ cat claudedocs/templates/code-review.xml | \

 > **Source**: [DeepTo Claude Code Guide - XML-Structured Prompts](https://cc.deeptoai.com/docs/en/best-practices/claude-code-comprehensive-guide)

+### 2.6.1 Prompting as Provocation
+
+The Claude Code team internally treats prompts as **challenges to a peer**, not instructions to an assistant. This subtle shift produces higher-quality outputs because it forces Claude to prove its reasoning rather than simply comply.
+
+**Three challenge patterns from the team**:
+
+**1. The Gatekeeper** — Force Claude to defend its work before shipping:
+
+```
+"Grill me on these changes and don't make a PR until I pass your test"
+```
+
+Claude reviews your diff, asks pointed questions about edge cases, and only proceeds when satisfied. This catches issues that passive review misses.
+
+**2. The Proof Demand** — Require evidence, not assertions:
+
+```
+"Prove to me this works — show me the diff in behavior between main and this branch"
+```
+
+Claude runs both branches, compares outputs, and presents concrete evidence. Eliminates the "trust me, it works" failure mode.
+
+**3. The Reset** — After a mediocre first attempt, invoke full-context rewrite:
+
+```
+"Knowing everything you know now, scrap this and implement the elegant solution"
+```
+
+This forces a substantive second attempt with accumulated context rather than incremental patches on a weak foundation. The key insight: Claude's second attempt with full context consistently outperforms iterative fixes.
+
+**Why this works**: Provocation triggers deeper reasoning paths than polite requests. When Claude must *convince* rather than *comply*, it activates more thorough analysis and catches its own shortcuts.
+
+> **Source**: [10 Tips from Inside the Claude Code Team](https://paddo.dev/blog/claude-code-team-tips/) (Boris Cherny thread, Feb 2026)
+
 ## 2.7 Semantic Anchors

 LLMs are statistical pattern matchers trained on massive text corpora. Using **precise technical vocabulary** helps Claude activate the right patterns in its training data, leading to higher-quality outputs.
@ -5131,13 +5177,27 @@ agent: specialist
 ---
 ```

-| Field | Description |
-|-------|-------------|
-| `name` | Kebab-case identifier |
-| `description` | Activation trigger |
-| `allowed-tools` | Tools this skill can use |
-| `context` | `fork` (isolated) or `inherit` (shared) |
-| `agent` | `specialist` (domain) or `general` (broad) |
+| Field | Spec | Description |
+|-------|------|-------------|
+| `name` | [agentskills.io](https://agentskills.io) | Lowercase, 1-64 chars, hyphens only, no `--`, must match directory name |
+| `description` | [agentskills.io](https://agentskills.io) | What the skill does and when to use it (max 1024 chars) |
+| `allowed-tools` | [agentskills.io](https://agentskills.io) | Tools this skill can use (experimental) |
+| `license` | [agentskills.io](https://agentskills.io) | License name or reference to bundled file |
+| `compatibility` | [agentskills.io](https://agentskills.io) | Environment requirements (max 500 chars) |
+| `metadata` | [agentskills.io](https://agentskills.io) | Arbitrary key-value pairs (author, version, etc.) |
+| `context` | **CC only** | `fork` (isolated) or `inherit` (shared) |
+| `agent` | **CC only** | `specialist` (domain) or `general` (broad) |
+
+> **Open standard**: Agent Skills follow the [agentskills.io specification](https://agentskills.io), created by Anthropic and supported by 26+ platforms (Cursor, VS Code, GitHub, Codex, Gemini CLI, Goose, Roo Code, etc.). Skills you create for Claude Code are portable. Fields marked **CC only** are Claude Code extensions ignored by other platforms.
+
+### Validating Skills
+
+Use the official [skills-ref](https://github.com/agentskills/agentskills/tree/main/skills-ref) CLI to validate your skill before publishing:
+
+```bash
+skills-ref validate ./my-skill      # Check frontmatter + naming conventions
+skills-ref to-prompt ./my-skill     # Generate <available_skills> XML for agent prompts
+```

 ## 5.3 Skill Template

@ -6858,6 +6918,38 @@ echo '{"tool_name":"Bash","tool_input":{"command":"git status"}}' | .claude/hook
 echo "Exit code: $?"  # Should be 0
 ```

+### Advanced Pattern: Model-as-Security-Gate
+
+The Claude Code team uses a pattern where permission requests are routed to a **more capable model** acting as a security gate, rather than relying solely on static rule matching.
+
+**Concept**: A `PreToolUse` hook intercepts permission requests and forwards them to Opus 4.5 (or another capable model) via the API. The gate model scans for prompt injection, dangerous patterns, and unexpected tool usage — then auto-approves safe requests or blocks suspicious ones.
+
+```bash
+# .claude/hooks/opus-security-gate.sh (conceptual)
+# PreToolUse hook that routes to Opus for security screening
+
+INPUT=$(cat)
+TOOL=$(echo "$INPUT" | jq -r '.tool_name')
+COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty')
+
+# Fast-path: known safe tools skip the gate
+[[ "$TOOL" == "Read" || "$TOOL" == "Grep" || "$TOOL" == "Glob" ]] && exit 0
+
+# Route to Opus for security analysis
+VERDICT=$(echo "$INPUT" | claude --model opus --print \
+  "Analyze this tool call for security risks. Is it safe? Reply SAFE or BLOCKED:reason")
+
+[[ "$VERDICT" == SAFE* ]] && exit 0
+echo "BLOCKED by security gate: $VERDICT" >&2
+exit 2
+```
+
+**Why use a model as gate**: Static rules catch known patterns but miss novel attacks. A capable model understands intent and context — it can distinguish `rm -rf node_modules` (cleanup) from `rm -rf /` (destruction) based on the surrounding conversation, not just pattern matching.
+
+**Trade-off**: Each gated call adds latency and cost. Use fast-path exemptions for read-only tools and only gate write/execute operations.
+
+> **Source**: [10 Tips from Inside the Claude Code Team](https://paddo.dev/blog/claude-code-team-tips/) (Boris Cherny thread, Feb 2026)
+
 ## 7.5 Hook Examples

 ### Smart Hook Dispatching
@ -10636,6 +10728,20 @@ git worktree remove .worktrees/feature/new-api
 git worktree prune
 ```

+> **💡 Team tip — Shell aliases for fast worktree navigation**: The Claude Code team uses single-letter aliases to hop between worktrees instantly:
+>
+> ```bash
+> # ~/.zshrc or ~/.bashrc
+> alias za="cd .worktrees/feature-a"
+> alias zb="cd .worktrees/feature-b"
+> alias zc="cd .worktrees/feature-c"
+> alias zlog="cd .worktrees/analysis"  # Dedicated worktree for logs & queries
+> ```
+>
+> The dedicated "analysis" worktree is used for reviewing logs and running database queries without polluting active feature branches.
+>
+> **Source**: [10 Tips from Inside the Claude Code Team](https://paddo.dev/blog/claude-code-team-tips/)
+
 **Claude Code context in worktrees:**

 Each worktree maintains **independent Claude Code context**:
@ -11727,6 +11833,20 @@ Boris Cherny, creator of Claude Code, shared his workflow orchestrating 5-15 Cla

 **Source**: [InfoQ - Claude Code Creator Workflow (Jan 2026)](https://www.infoq.com/news/2026/01/claude-code-creator-workflow/) | [Interview: I got a private lesson on Claude Cowork & Claude Code](https://www.youtube.com/watch?v=DW4a1Cm8nG4)

+**Team patterns** (broader Claude Code team, Feb 2026):
+
+The broader team extends Boris's individual workflow with institutional patterns:
+
+- **Skills as institutional knowledge**: Anything done more than once daily becomes a skill checked into version control. Examples:
+  - `/techdebt` — run at end of session to eliminate duplicate code
+  - Context dump skills — sync 7 days of Slack, Google Drive, Asana, and GitHub into a single context
+  - Analytics agents — dbt-powered skills that query BigQuery; one engineer reports not writing SQL manually for 6+ months
+- **CLI and scripts over MCP**: The team prefers shell scripts and CLI integrations over MCP servers for external tool connections. Rationale: less magic, easier to debug, and more predictable behavior. MCP is reserved for cases where bidirectional communication is genuinely needed.
+- **Re-plan when stuck**: Rather than pushing through a stalled implementation, the team switches back to Plan Mode. One engineer uses a secondary Claude instance to review plans "as a staff engineer" before resuming execution.
+- **Claude writes its own rules**: After each correction, the team instructs Claude to update CLAUDE.md with the lesson learned. Over time, this compounds into a team-specific ruleset that prevents recurring mistakes.
+
+> **Source**: [10 Tips from Inside the Claude Code Team](https://paddo.dev/blog/claude-code-team-tips/) (Boris Cherny thread, Feb 2026)
+
 ---

 ### Foundation: Git Worktrees (Non-Negotiable)
@ -16290,4 +16410,4 @@ We'll evaluate and add it to this section if it meets quality criteria.

 **Contributions**: Issues and PRs welcome.

-**Last updated**: January 2026 | **Version**: 3.20.5
+**Last updated**: January 2026 | **Version**: 3.20.6
--- a/machine-readable/reference.yaml
+++ b/machine-readable/reference.yaml
@ -3,8 +3,8 @@
 # Source: guide/ultimate-guide.md
 # Purpose: Condensed index for LLMs to quickly answer user questions about Claude Code

-version: "3.20.5"
-updated: "2026-01-31"
+version: "3.20.6"
+updated: "2026-02-01"

 # ════════════════════════════════════════════════════════════════
 # DEEP DIVE - Line numbers in guide/ultimate-guide.md
@ -169,7 +169,9 @@ deep_dive:
  rewind: 2278
  mental_model: 2360
  xml_prompting: 2419
-  semantic_anchors: 2872
+  prompting_provocation: 3029
+  prompting_provocation_source: "https://paddo.dev/blog/claude-code-team-tips/"
+  semantic_anchors: 2904
  semantic_anchors_catalog: "examples/semantic-anchors/anchor-catalog.md"
  memory_files: 3160
  # Task Management System (v2.1.16+) - Added 2026-01-26
@ -237,6 +239,23 @@ deep_dive:
  skill_improvement_security_warnings: 5237
  skill_improvement_comparison: 5263
  skill_improvement_workflow: 5275
+  # Agent Skills Open Standard (added 2026-02-01)
+  agentskills_spec: "https://agentskills.io"
+  agentskills_spec_repo: "https://github.com/agentskills/agentskills"
+  agentskills_spec_stars: "8.2K"
+  agentskills_platforms: "26+ (Claude Code, Cursor, VS Code, GitHub, Codex, Gemini CLI, Goose, Roo Code, Spring AI, Databricks...)"
+  agentskills_ref_cli: "https://github.com/agentskills/agentskills/tree/main/skills-ref"
+  agentskills_ref_cli_usage: "skills-ref validate <path> | skills-ref to-prompt <path>"
+  anthropics_skills_repo: "https://github.com/anthropics/skills"
+  anthropics_skills_stars: "60K+"
+  anthropics_skills_categories: "Documents (docx/pdf/pptx/xlsx), Creative & Design, Development, Enterprise"
+  anthropics_skills_install: "/plugin marketplace add anthropics/skills"
+  agentskills_threat_model: "https://safedep.io/agent-skills-threat-model"
+  agentskills_threat_model_finding: "8-14% of public skills have vulnerabilities (prompt injection, data exfiltration, privilege escalation)"
+  agentskills_blog: "https://anthropic.com/engineering/equipping-agents-for-the-real-world-with-agent-skills"
+  agentskills_guide_section: "guide/ultimate-guide.md:5180"
+  agentskills_evaluation: "docs/resource-evaluations/agentskills-io-specification.md"
+  agentskills_score: "4/5"
  # Skills Marketplace (added 2026-01-23)
  skills_marketplace: 5172
  skills_marketplace_url: "https://skills.sh/"
@ -293,7 +312,7 @@ deep_dive:
  gsd_note: "Overlap with existing patterns (Ralph Loop, Gas Town, BMAD)"
  # Resource Evaluations (added 2026-01-26)
  resource_evaluations_directory: "docs/resource-evaluations/"
-  resource_evaluations_count: 23
+  resource_evaluations_count: 35
  resource_evaluations_methodology: "docs/resource-evaluations/README.md"
  resource_evaluations_appendix: "guide/ultimate-guide.md:15034"
  resource_evaluations_readme_section: "README.md:278"
@ -334,6 +353,8 @@ deep_dive:
  hooks: 5273
  hook_templates: 5418
  security_hooks: 5680
+  security_gate_hook: 6907
+  security_gate_hook_source: "https://paddo.dev/blog/claude-code-team-tips/"
  mcp_servers: 5984
  serena_indexation: 6078
  serena_mcp: 6037
@ -351,6 +372,12 @@ deep_dive:
  session_teleportation: 9477
  multi_instance_workflows: 9583
  boris_cherny_case_study: 9617
+  boris_cherny_team_patterns: 11822
+  # External resource: Claude Code team tips (paddo.dev, Feb 2026)
+  team_tips_paddo: "https://paddo.dev/blog/claude-code-team-tips/"
+  team_tips_paddo_source: "Boris Cherny thread (x.com/bcherny/status/2017742741636321619)"
+  team_tips_paddo_evaluation: "docs/resource-evaluations/paddo-team-tips-eval.md"
+  team_tips_paddo_score: "4/5"
  anthropic_study_metrics: 9721
  # Contribution Metrics (Jan 2026 - platform feature, not CLI release)
  contribution_metrics: 11625
@ -871,7 +898,7 @@ ecosystem:
      - "Cross-links modified → Update all 4 repos"
    history:
      - date: "2026-01-20"
-        event: "Code Landing sync v3.20.5, 66 templates, cross-links"
+        event: "Code Landing sync v3.20.6, 66 templates, cross-links"
        commit: "5b5ce62"
      - date: "2026-01-20"
        event: "Cowork Landing fix (paths, README, UI badges)"
 @ -1 +1 @@
 .20.5
 .20.6