docs: Add skills frontmatter field documentation

Document the `skills` frontmatter field added in v2.0.43 for declaring
skills to auto-load for subagents and commands. This helps ensure skills
persist across context compaction by explicitly declaring required skills.

- Add skills field to agent-development SKILL.md frontmatter fields section
- Add skills field to command-development frontmatter-reference.md
- Update examples, validation checklists, and best practices

CHANGELOG.md

@@ -1,98 +1,5 @@
 # Changelog
 
-## 2.0.74
-
-- Added LSP (Language Server Protocol) tool for code intelligence features like go-to-definition, find references, and hover documentation
-- Added `/terminal-setup` support for Kitty, Alacritty, Zed, and Warp terminals
-- Added ctrl+t shortcut in `/theme` to toggle syntax highlighting on/off
-- Added syntax highlighting info to theme picker
-- Added guidance for macOS users when Alt shortcuts fail due to terminal configuration
-- Fixed skill `allowed-tools` not being applied to tools invoked by the skill
-- Fixed Opus 4.5 tip incorrectly showing when user was already using Opus
-- Fixed a potential crash when syntax highlighting isn't initialized correctly
-- Fixed visual bug in `/plugins discover` where list selection indicator showed while search box was focused
-- Fixed macOS keyboard shortcuts to display 'opt' instead of 'alt'
-- Improved `/context` command visualization with grouped skills and agents by source, slash commands, and sorted token count
-- [Windows] Fixed issue with improper rendering
-- [VSCode] Added gift tag pictogram for year-end promotion message
-
-## 2.0.73
-
-- Added clickable `[Image #N]` links that open attached images in the default viewer
-- Added alt-y yank-pop to cycle through kill ring history after ctrl-y yank
-- Added search filtering to the plugin discover screen (type to filter by name, description, or marketplace)
-- Added support for custom session IDs when forking sessions with `--session-id` combined with `--resume` or `--continue` and `--fork-session`
-- Fixed slow input history cycling and race condition that could overwrite text after message submission
-- Improved `/theme` command to open theme picker directly
-- Improved theme picker UI
-- Improved search UX across resume session, permissions, and plugins screens with a unified SearchBox component
-- [VSCode] Added tab icon badges showing pending permissions (blue) and unread completions (orange)
-
-## 2.0.72
-
-- Added Claude in Chrome (Beta) feature that works with the Chrome extension (https://claude.ai/chrome) to let you control your browser directly from Claude Code
-- Reduced terminal flickering
-- Added scannable QR code to mobile app tip for quick app downloads
-- Added loading indicator when resuming conversations for better feedback
-- Fixed `/context` command not respecting custom system prompts in non-interactive mode
-- Fixed order of consecutive Ctrl+K lines when pasting with Ctrl+Y
-- Improved @ mention file suggestion speed (~3x faster in git repositories)
-- Improved file suggestion performance in repos with `.ignore` or `.rgignore` files
-- Improved settings validation errors to be more prominent
-- Changed thinking toggle from Tab to Alt+T to avoid accidental triggers
-
-## 2.0.71
-
-- Added /config toggle to enable/disable prompt suggestions
-- Added `/settings` as an alias for the `/config` command
-- Fixed @ file reference suggestions incorrectly triggering when cursor is in the middle of a path
-- Fixed MCP servers from `.mcp.json` not loading when using `--dangerously-skip-permissions`
-- Fixed permission rules incorrectly rejecting valid bash commands containing shell glob patterns (e.g., `ls *.txt`, `for f in *.png`)
-- Bedrock: Environment variable `ANTHROPIC_BEDROCK_BASE_URL` is now respected for token counting and inference profile listing
-- New syntax highlighting engine for native build
-
-## 2.0.70
-
-- Added Enter key to accept and submit prompt suggestions immediately (tab still accepts for editing)
-- Added wildcard syntax `mcp__server__*` for MCP tool permissions to allow or deny all tools from a server
-- Added auto-update toggle for plugin marketplaces, allowing per-marketplace control over automatic updates
-- Added `current_usage` field to status line input, enabling accurate context window percentage calculations
-- Fixed input being cleared when processing queued commands while the user was typing
-- Fixed prompt suggestions replacing typed input when pressing Tab
-- Fixed diff view not updating when terminal is resized
-- Improved memory usage by 3x for large conversations
-- Improved resolution of stats screenshots copied to clipboard (Ctrl+S) for crisper images
-- Removed # shortcut for quick memory entry (tell Claude to edit your CLAUDE.md instead)
-- Fix thinking mode toggle in /config not persisting correctly
-- Improve UI for file creation permission dialog
-
-## 2.0.69
-
-- Minor bugfixes
-
-## 2.0.68
-
-- Fixed IME (Input Method Editor) support for languages like Chinese, Japanese, and Korean by correctly positioning the composition window at the cursor
-- Fixed a bug where disallowed MCP tools were visible to the model
-- Fixed an issue where steering messages could be lost while a subagent is working
-- Fixed Option+Arrow word navigation treating entire CJK (Chinese, Japanese, Korean) text sequences as a single word instead of navigating by word boundaries
-- Improved plan mode exit UX: show simplified yes/no dialog when exiting with empty or missing plan instead of throwing an error
-- Add support for enterprise managed settings. Contact your Anthropic account team to enable this feature.
-
-## 2.0.67
-
-- Thinking mode is now enabled by default for Opus 4.5
-- Thinking mode configuration has moved to /config
-- Added search functionality to `/permissions` command with `/` keyboard shortcut for filtering rules by tool name
-- Show reason why autoupdater is disabled in `/doctor`
-- Fixed false "Another process is currently updating Claude" error when running `claude update` while another instance is already on the latest version
-- Fixed MCP servers from `.mcp.json` being stuck in pending state when running in non-interactive mode (`-p` flag or piped input)
-- Fixed scroll position resetting after deleting a permission rule in `/permissions`
-- Fixed word deletion (opt+delete) and word navigation (opt+arrow) not working correctly with non-Latin text such as Cyrillic, Greek, Arabic, Hebrew, Thai, and Chinese
-- Fixed `claude install --force` not bypassing stale lock files
-- Fixed consecutive @~/ file references in CLAUDE.md being incorrectly parsed due to markdown strikethrough interference
-- Windows: Fixed plugin MCP servers failing due to colons in log directory paths
-
 ## 2.0.65
 
 - Added ability to switch models while writing a prompt using alt+p (linux, windows), option+p (macos).
@@ -116,7 +23,6 @@
 - VSCode: Added copy-to-clipboard button on code blocks and bash tool inputs
 - VSCode: Fixed extension not working on Windows ARM64 by falling back to x64 binary via emulation
 - Bedrock: Improve efficiency of token counting
-- Bedrock: Add support for `aws login` AWS Management Console credentials
 - Unshipped AgentOutputTool and BashOutputTool, in favor of a new unified TaskOutputTool
 
 ## 2.0.62

plugins/code-review/README.md

@@ -22,29 +22,23 @@ Performs automated code review on a pull request using multiple specialized agen
    - **Agent #4**: Analyze git blame/history for context-based issues
 5. Scores each issue 0-100 for confidence level
 6. Filters out issues below 80 confidence threshold
-7. Outputs review (to terminal by default, or as PR comment with `--comment` flag)
+7. Posts review comment with high-confidence issues only
 
 **Usage:**
 ```bash
-/code-review [--comment]
+/code-review
 ```
 
-**Options:**
-- `--comment`: Post the review as a comment on the pull request (default: outputs to terminal only)
-
 **Example workflow:**
 ```bash
-# On a PR branch, run locally (outputs to terminal):
+# On a PR branch, run:
 /code-review
 
-# Post review as PR comment:
-/code-review --comment
-
 # Claude will:
 # - Launch 4 review agents in parallel
 # - Score each issue for confidence
-# - Output issues ≥80 confidence (to terminal or PR depending on flag)
-# - Skip if no high-confidence issues found
+# - Post comment with issues ≥80 confidence
+# - Skip posting if no high-confidence issues found
 ```
 
 **Features:**
@@ -120,23 +114,17 @@ This plugin is included in the Claude Code repository. The command is automatica
 ### Standard PR review workflow:
 ```bash
 # Create PR with changes
-# Run local review (outputs to terminal)
 /code-review
 
 # Review the automated feedback
 # Make any necessary fixes
-
-# Optionally post as PR comment
-/code-review --comment
-
 # Merge when ready
 ```
 
 ### As part of CI/CD:
 ```bash
 # Trigger on PR creation or update
-# Use --comment flag to post review comments
-/code-review --comment
+# Automatically posts review comments
 # Skip if review already exists
 ```
 

plugins/code-review/commands/code-review.md

@@ -1,5 +1,5 @@
 ---
-allowed-tools: Bash(gh issue view:*), Bash(gh search:*), Bash(gh issue list:*), Bash(gh pr comment:*), Bash(gh pr diff:*), Bash(gh pr view:*), Bash(gh pr list:*), mcp__github_inline_comment__create_inline_comment
+allowed-tools: Bash(gh issue view:*), Bash(gh search:*), Bash(gh issue list:*), Bash(gh pr comment:*), Bash(gh pr diff:*), Bash(gh pr view:*), Bash(gh pr list:*)
 description: Code review a pull request
 ---
 
@@ -11,7 +11,7 @@ To do this, follow these steps precisely:
    - The pull request is closed
    - The pull request is a draft
    - The pull request does not need code review (e.g. automated PR, trivial change that is obviously correct)
-   - Claude has already commented on this PR (check `gh pr view <PR> --comments` for comments left by claude)
+   - You have already submitted a code review on this pull request
 
    If any condition is true, stop and do not proceed.
 
@@ -52,30 +52,12 @@ Note: Still review Claude generated PR's.
 
 6. Filter out any issues that were not validated in step 5. This step will give us our list of high signal issues for our review.
 
-7. If issues were found, skip to step 8 to post inline comments directly.
-
-   If NO issues were found, post a summary comment using `gh pr comment` (if `--comment` argument is provided):
-   "No issues found. Checked for bugs and CLAUDE.md compliance."
-
-8. Post inline comments for each issue using `mcp__github_inline_comment__create_inline_comment`:
-   - `path`: the file path
-   - `line` (and `startLine` for ranges): select the buggy lines so the user sees them
-   - `body`: Brief description of the issue (no "Bug:" prefix). For small fixes (up to 5 lines changed), include a committable suggestion:
-     ```suggestion
-     corrected code here
-     ```
-
-     **Suggestions must be COMPLETE.** If a fix requires additional changes elsewhere (e.g., renaming a variable requires updating all usages), do NOT use a suggestion block. The author should be able to click "Commit suggestion" and have a working fix - no followup work required.
-
-     For larger fixes (6+ lines, structural changes, or changes spanning multiple locations), do NOT use suggestion blocks. Instead:
-     1. Describe what the issue is
-     2. Explain the suggested fix at a high level
-     3. Include a copyable prompt for Claude Code that the user can use to fix the issue, formatted as:
-        ```
-        Fix [file:line]: [brief description of issue and suggested fix]
-        ```
-
-   **IMPORTANT: Only post ONE comment per unique issue. Do not post duplicate comments.**
+7. Finally, comment on the pull request.
+   When writing your comment, follow these guidelines:
+   a. Keep your output brief
+   b. Avoid emojis
+   c. Link and cite relevant code, files, and URLs for each issue
+   d. When citing CLAUDE.md violations, you MUST quote the exact text from CLAUDE.md that is being violated (e.g., CLAUDE.md says: "Use snake_case for variable names")
 
 Use this list when evaluating issues in Steps 4 and 5 (these are false positives, do NOT flag):
 
@@ -90,18 +72,47 @@ Notes:
 
 - Use gh CLI to interact with GitHub (e.g., fetch pull requests, create comments). Do not use web fetch.
 - Create a todo list before starting.
-- You must cite and link each issue in inline comments (e.g., if referring to a CLAUDE.md, include a link to it).
-- If no issues are found, post a comment with the following format:
+- You must cite and link each issue (e.g., if referring to a CLAUDE.md, include a link to it).
+- For your final comment, follow the following format precisely (assuming for this example that you found 3 issues):
 
 ---
 
 ## Code review
 
-No issues found. Checked for bugs and CLAUDE.md compliance.
+Found 3 issues:
+
+1. <brief description of bug> (CLAUDE.md says: "<exact quote from CLAUDE.md>")
+
+<link to file and line with full sha1 + line range for context, eg. https://github.com/anthropics/claude-code/blob/1d54823877c4de72b2316a64032a54afc404e619/README.md#L13-L17>
+
+2. <brief description of bug> (some/other/CLAUDE.md says: "<exact quote from CLAUDE.md>")
+
+<link to file and line with full sha1 + line range for context>
+
+3. <brief description of bug> (bug due to <file and code snippet>)
+
+<link to file and line with full sha1 + line range for context>
+
+🤖 Generated with [Claude Code](https://claude.ai/code)
+
+
+<sub>- If this code review was useful, please react with 👍. Otherwise, react with 👎.</sub>
 
 ---
 
-- When linking to code in inline comments, follow the following format precisely, otherwise the Markdown preview won't render correctly: https://github.com/anthropics/claude-code/blob/c21d3c10bc8e898b7ac1a2d745bdc9bc4e423afe/package.json#L10-L15
+- Or, if you found no issues:
+
+---
+
+## Auto code review
+
+No issues found. Checked for bugs and CLAUDE.md compliance.
+
+🤖 Generated with [Claude Code](https://claude.ai/code)
+
+---
+
+- When linking to code, follow the following format precisely, otherwise the Markdown preview won't render correctly: https://github.com/anthropics/claude-code/blob/c21d3c10bc8e898b7ac1a2d745bdc9bc4e423afe/package.json#L10-L15
   - Requires full git sha
   - You must provide the full sha. Commands like `https://github.com/owner/repo/blob/$(git rev-parse HEAD)/foo/bar` will not work, since your comment will be directly rendered in Markdown.
   - Repo name must match the repo you're code reviewing

plugins/plugin-dev/skills/agent-development/SKILL.md

@@ -42,6 +42,7 @@ assistant: "[How assistant should respond and use this agent]"
 model: inherit
 color: blue
 tools: ["Read", "Write", "Grep"]
+skills: skill-name-1, skill-name-2
 ---
 
 You are [agent role description]...
@@ -159,6 +160,35 @@ tools: ["Read", "Write", "Grep", "Bash"]
 - Testing: `["Read", "Bash", "Grep"]`
 - Full access: Omit field or use `["*"]`
 
+### skills (optional)
+
+Declare skills to auto-load when this agent is invoked.
+
+**Format:** Comma-separated list of skill names
+
+```yaml
+skills: database-migration, postgres-ops
+```
+
+**Purpose:** Ensures specific skills are always available to the agent, regardless of context matching. This is especially useful for:
+- Skills that should persist across context compaction
+- Specialized agents that always need certain domain knowledge
+- Ensuring consistent agent behavior with required skills
+
+**Example:**
+```yaml
+---
+name: db-admin
+description: Use this agent for database administration tasks...
+model: inherit
+color: cyan
+tools: ["Bash", "Read", "Write"]
+skills: database-migration, sql-optimization
+---
+```
+
+**Best practice:** Only declare skills essential to the agent's core function. Let context-triggered skills load naturally for optional capabilities.
+
 ## System Prompt Design
 
 The markdown body becomes the agent's system prompt. Write in second person, addressing the agent directly.
@@ -355,6 +385,7 @@ Output: [What to provide]
 | model | Yes | inherit/sonnet/opus/haiku | inherit |
 | color | Yes | Color name | blue |
 | tools | No | Array of tool names | ["Read", "Grep"] |
+| skills | No | Comma-separated names | skill-a, skill-b |
 
 ### Best Practices
 

plugins/plugin-dev/skills/command-development/references/frontmatter-reference.md

@@ -12,6 +12,7 @@ description: Brief description
 allowed-tools: Read, Write
 model: sonnet
 argument-hint: [arg1] [arg2]
+skills: skill-a, skill-b
 ---
 
 Command prompt content here...
@@ -321,6 +322,51 @@ disable-model-invocation: true
 - Document why in command comments
 - Consider if command should exist if always manual
 
+### skills
+
+**Type:** String (comma-separated list)
+**Required:** No
+**Default:** None
+
+**Purpose:** Declare skills to auto-load when this command executes. Ensures specific skills are always available regardless of context matching.
+
+**Examples:**
+```yaml
+skills: database-migration, sql-optimization
+```
+
+**When to use:**
+
+1. **Commands requiring domain knowledge:** Ensure relevant skills load
+   ```yaml
+   ---
+   description: Run database migration
+   skills: database-migration, postgres-ops
+   ---
+   ```
+
+2. **Skills that should persist across compaction:** Force-load skills that might otherwise be lost
+   ```yaml
+   ---
+   description: Complex multi-step workflow
+   skills: workflow-skill, validation-skill
+   ---
+   ```
+
+3. **Specialized commands:** Commands that always need specific expertise
+   ```yaml
+   ---
+   description: Generate API documentation
+   skills: api-documentation, openapi-spec
+   ---
+   ```
+
+**Best practices:**
+- Only declare skills essential to the command's function
+- Use skill names exactly as defined in SKILL.md frontmatter
+- Keep the list focused (2-4 skills max)
+- Let context-triggered skills load naturally for optional capabilities
+
 ## Complete Examples
 
 ### Minimal Command
@@ -451,6 +497,7 @@ Before committing command:
 - [ ] model is valid value if specified
 - [ ] argument-hint matches positional arguments
 - [ ] disable-model-invocation used appropriately
+- [ ] skills references valid skill names if specified
 
 ## Best Practices Summary
 
@@ -460,4 +507,5 @@ Before committing command:
 4. **Choose right model:** Use haiku for speed, opus for complexity
 5. **Manual-only sparingly:** Only use disable-model-invocation when necessary
 6. **Clear descriptions:** Make commands discoverable in `/help`
-7. **Test thoroughly:** Verify frontmatter works as expected
+7. **Declare essential skills:** Use skills field for domain knowledge that must persist
+8. **Test thoroughly:** Verify frontmatter works as expected

plugins/plugin-dev/skills/mcp-integration/references/authentication.md

@@ -264,139 +264,6 @@ EOF
 - Time-based authentication
 - Dynamic tenant/workspace selection
 
-### TTL Configuration
-
-By default, dynamically generated API keys are cached for 5 minutes. Configure the TTL with:
-
-```bash
-export CLAUDE_CODE_API_KEY_HELPER_TTL_MS=300000  # 5 minutes (default)
-```
-
-### Writing Robust Helper Scripts
-
-Helper scripts can cause issues if they hang or fail repeatedly. Follow these best practices to prevent infinite retry loops and connection hangs:
-
-**1. Always set timeouts on network operations:**
-```bash
-#!/bin/bash
-# get-token.sh - Robust token fetcher
-
-# Set a timeout for the entire script
-TIMEOUT_SECONDS=10
-
-# Use timeout for network calls
-TOKEN=$(timeout ${TIMEOUT_SECONDS}s curl -s --max-time ${TIMEOUT_SECONDS} \
-  "https://auth.example.com/token" 2>/dev/null)
-
-if [ -z "$TOKEN" ] || [ "$TOKEN" = "null" ]; then
-  # Exit with error - don't output invalid JSON
-  echo "Failed to fetch token" >&2
-  exit 1
-fi
-
-echo "{\"Authorization\": \"Bearer $TOKEN\"}"
-```
-
-**2. Handle VPN/network dependency failures:**
-```bash
-#!/bin/bash
-# get-headers.sh - VPN-aware token fetcher
-
-# Quick connectivity check before attempting auth
-if ! timeout 2s ping -c 1 vpn-dependent-service.internal >/dev/null 2>&1; then
-  echo "VPN not connected or service unreachable" >&2
-  exit 1
-fi
-
-# Proceed with token fetch (with timeout)
-TOKEN=$(timeout 10s get-token-from-vpn-service)
-
-if [ $? -ne 0 ] || [ -z "$TOKEN" ]; then
-  echo "Token fetch failed" >&2
-  exit 1
-fi
-
-echo "{\"Authorization\": \"Bearer $TOKEN\"}"
-```
-
-**3. Cache tokens locally to reduce network calls:**
-```bash
-#!/bin/bash
-# get-headers-cached.sh - Token fetcher with local caching
-
-CACHE_FILE="${HOME}/.cache/my-api-token"
-CACHE_MAX_AGE=240  # seconds (refresh before 5min TTL)
-
-# Check cache validity
-if [ -f "$CACHE_FILE" ]; then
-  CACHE_AGE=$(($(date +%s) - $(stat -c %Y "$CACHE_FILE" 2>/dev/null || stat -f %m "$CACHE_FILE")))
-  if [ "$CACHE_AGE" -lt "$CACHE_MAX_AGE" ]; then
-    cat "$CACHE_FILE"
-    exit 0
-  fi
-fi
-
-# Fetch new token with timeout
-TOKEN=$(timeout 10s fetch-new-token 2>/dev/null)
-
-if [ -z "$TOKEN" ]; then
-  # If fetch fails, try to use expired cache as fallback
-  if [ -f "$CACHE_FILE" ]; then
-    echo "Warning: Using expired cached token" >&2
-    cat "$CACHE_FILE"
-    exit 0
-  fi
-  echo "Failed to fetch token and no cache available" >&2
-  exit 1
-fi
-
-# Update cache
-mkdir -p "$(dirname "$CACHE_FILE")"
-echo "{\"Authorization\": \"Bearer $TOKEN\"}" > "$CACHE_FILE"
-cat "$CACHE_FILE"
-```
-
-**4. Fail fast with clear error messages:**
-```bash
-#!/bin/bash
-set -e  # Exit on any error
-
-# Check prerequisites before attempting network calls
-if [ -z "$API_SECRET" ]; then
-  echo "API_SECRET environment variable not set" >&2
-  exit 1
-fi
-
-# Use short timeouts to fail fast
-TOKEN=$(timeout 5s curl -sf --max-time 5 \
-  -H "X-Secret: $API_SECRET" \
-  "https://auth.example.com/token") || {
-  echo "Token request failed or timed out" >&2
-  exit 1
-}
-
-echo "{\"Authorization\": \"Bearer $TOKEN\"}"
-```
-
-### Troubleshooting Helper Scripts
-
-**Infinite retry loop / hanging:**
-- Add timeouts to all network operations
-- Use `set -e` to exit on errors
-- Check VPN/network connectivity before making requests
-- Ensure script outputs valid JSON or exits with error code
-
-**Script takes too long:**
-- Use `timeout` command wrapper
-- Set `--max-time` on curl requests
-- Consider caching tokens locally
-- Reduce TTL if tokens refresh too slowly
-
-**VPN-dependent helpers failing:**
-- Add connectivity check at start of script
-- Implement graceful degradation with cached tokens
-- Log clear error messages to stderr
-
 ## Security Best Practices
 
 ### DO