16. Packaging Standard Operating Procedures (Agent Skills)

In Episode 23 of Beyond Prompting, author Sho Shimoda addresses how to govern, deploy, and observe Claude Code across an enterprise organization. When a security review asks what stops an employee or agent from performing unauthorized actions, answering effectively requires distinguishing hard boundaries from simple guidance. In this episode, we break down:The Three Tiers of Enforceability: Categorizing controls into Top Tier (OS/MDM-enforced boundaries that hold against an uncooperative user), Middle Tier (client-side controls enforced while the client cooperates, such as permission rules), and Bottom Tier (guidance and prompt-level instructions like CLAUDE.md).What Managed Settings Enforce: Leveraging managed-settings.json deployed via MDM to lock down sandbox paths, restrict API domains, set mandatory deny rules, and restrict connected MCP servers and plugin marketplaces.Observability & Telemetry: Streaming operational metrics over OpenTelemetry—tracking prompts, tool calls, file access, skills, and approvals—to create a complete audit log before security incidents occur.Deployment Options & Zero Data Retention: Comparing direct API usage against cloud provider gateways (AWS Bedrock, Google Cloud, Microsoft Foundry), understanding feature availability tradeoffs, and navigating Zero Data Retention (ZDR) policies.A Rollout Strategy That Survives Security Review: Establishing a five-step deployment sequence—setting enforced OS controls first, enabling observability before user adoption, refining client permissions, and writing guidance last.(Note for listeners: This episode covers Chapter 23 of Sho Shimoda's book RUNNING CLAUDE: The Operator’s Guide to Chat, Cowork and Claude Code, available on Amazon as the successor book to Master Claude: Chat, Cowork and Code).

In Episode 22 of Beyond Prompting, author Sho Shimoda addresses the security accounting of autonomous AI agents. An agent that generates text can only be wrong; an agent that executes commands can be wrong in ways that persist after the conversation ends. In this episode, we break down:Four Core Execution Risks: Analyzing command injection from interpolated content, destructive file operations across unexpected path scopes (such as rm -rf "$DIR"/*), prompt injection via hostile untrusted files, and unauthorized data exposure.Boundaries Across the Three Surfaces: Comparing Chat (reaches nothing), Cowork (ephemeral cloud sandboxes with a desktop app broker), and Claude Code (runs directly on your host machine with an OS-enforced shell boundary).What the OS Sandbox Actually Enforces: How Seatbelt (macOS) and bubblewrap (Linux/WSL2) constrain shell commands at the OS level—holding even if prompt injection bypasses model decision-making—while recognizing what sits outside it (file tools, MCP servers, and hooks).Handling Prompt Injection Structurally: Why prompts are not security boundaries, and why defending against prompt injection requires a three-layer structural strategy: scoping permissions, constraining shell reach via the sandbox, and explicitly denying access to credential paths (~/.ssh, ~/.aws).Constraining Damage vs. Guaranteeing Safety: Internalizing the foundational rule of agent security: "The sandbox constrains the scope of damage. It does not make operations safe."(Note for listeners: This episode covers Chapter 22 of Sho Shimoda's book RUNNING CLAUDE: The Operator’s Guide to Chat, Cowork and Claude Code, available on Amazon as the successor book to Master Claude: Chat, Cowork and Code).

In Episode 21 of Beyond Prompting, author Sho Shimoda explores how to break through the manual chat window bottleneck by programmatically orchestrating AI agents using Dynamic Workflows. When coordinating large-scale engineering tasks across a codebase, managing dozens of parallel tasks manually through a chat transcript becomes a major bottleneck. In this episode, we break down:When Scripts Beat Conversations: The three conditions that justify a workflow script—large volume (20+ items), complete task independence, and aggregated findings.JavaScript Workflow Mechanics: Writing deterministic orchestration scripts using agent(), pipeline(), parallel(), phase(), and log(), while enforcing strict replayability rules that block non-deterministic calls like Date.now() or import().Prompt Caching at Scale: How Claude Code holds parallel agent fan-outs briefly at startup so subagents share a single cached prompt prefix, dramatically lowering execution costs.Security & Execution Boundaries: Why workflows require explicit user invocation via the ultracode keyword and cannot be triggered automatically by untrusted webhooks, scheduled tasks, or pull request comments.The Two-Phase Pattern: Designing trustworthy automation through a two-phase architecture—Phase 1 surveys and generates candidate findings, while Phase 2 runs an adversarial verification step on each finding before aggregating results.(Note for listeners: This episode covers Chapter 21 of Sho Shimoda's book RUNNING CLAUDE: The Operator’s Guide to Chat, Cowork and Claude Code, available on Amazon as the successor book to Master Claude: Chat, Cowork and Code).

In Episode 20 of Beyond Prompting, author Sho Shimoda clarifies how to run multiple AI tasks concurrently without getting tangled in state or disk conflicts. While Chapter 19 focused on subagents, Chapter 20 introduces three other mechanisms for parallelism, organizing all four around what gets separated: context, attention, whole sessions, or files. In this episode, we cover:The Four Parallelism Mechanisms: Distinguishing between Subagents (separates context window), Background Sessions (separates attention), Agent Teams (separates whole sessions), and Git Worktrees (separates working tree files).Teammates vs. Subagents: Why teammates in an agent team operate as peer sessions that message each other and share a task list rather than reporting upward to a caller, and why coordination costs mean most tasks are better served by a well-specified single session.Cross-Session Messaging: Using /list-agents and SendMessage to let active terminal sessions communicate across project boundaries, governed by the crossSessionInbound setting.Worktrees for File Collisions: Creating isolated Git checkouts with claude --worktree <name> so parallel sessions don't overwrite each other's files on disk, and copying ignored local environment files using .worktreeinclude.Managing Parallel Load: Using the agent view (claude agents) to monitor background execution, and understanding why parallel worktrees and agent teams carry separate prompt caches.(Note for listeners: This episode covers Chapter 20 of Sho Shimoda's book RUNNING CLAUDE: The Operator’s Guide to Chat, Cowork and Claude Code, available on Amazon as the successor book to Master Claude: Chat, Cowork and Code).

In Episode 19 of Beyond Prompting, author Sho Shimoda explores how to manage complex, search-heavy engineering tasks without cluttering your main conversation window using Subagents. When an agent reads dozens of files, runs multiple searches, and pursues false leads, that intermediate noise dilutes the main conversation's working memory. In this episode, we break down:Solving Context Pollution: Why the primary benefit of delegation is keeping your main conversation's context clean by running heavy investigations in isolated, disposable subagent context windows that return only concise summaries.The Three Justifications for Subagents: Identifying when to delegate based on context economy (high byproduct-to-conclusion ratio), specialized roles (such as a read-only security or schema reviewer), and true task parallelism.Defining Subagents (.claude/agents/): Structuring custom subagents in Markdown with YAML frontmatter, restricting tool access (e.g. limiting to Read, Grep, and Glob), and why writing a clear description field is the entire invocation mechanism.What Crosses the Boundary: Understanding what a subagent inherits (system prompt, CLAUDE.md, git snapshot, brief) versus what stays isolated (conversation history and intermediate tool outputs), and using agent IDs to resume subagents via SendMessage.Forks, Depth, and Concurrency: Distinguishing standard subagents from forks (/subtask), navigating spawn depth limits (up to 3 layers), concurrency caps (up to 20 subagents), and knowing when not to delegate.(Note for listeners: This episode covers Chapter 19 of Sho Shimoda's book RUNNING CLAUDE: The Operator’s Guide to Chat, Cowork and Claude Code, available on Amazon as the successor book to Master Claude: Chat, Cowork and Code).

In Episode 18 of Beyond Prompting, author Sho Shimoda explores how to bundle your team's custom skills, commands, subagents, hooks, and MCP server configurations into a single, installable unit using Plugins. Rather than manually sharing scattered configuration files with colleagues, Plugins allow teams to package and distribute entire operational capabilities effortlessly. In this episode, we cover:The Anatomy of a Plugin: How a plugin is structured as a directory with a .claude-plugin/plugin.json manifest and optional component folders (skills/, commands/, agents/, hooks/, .mcp.json, and workflows/).Automatic Namespacing: How plugin components are namespaced upon arrival (e.g., /acme-standards:review), allowing multiple plugins to coexist safely without name collisions.Managing the Lifecycle: Using claude plugin commands (install, enable, disable, update, validate) and browsing official marketplaces (claude-plugins-official and claude-community).Publishing Internal Marketplaces: How to host a private team marketplace using a Git repository containing a .claude-plugin/marketplace.json index file.Plugins in Cowork: Bundling operational skills, connectors, and subagents for non-engineering teams via the Knowledge Work marketplace.Security & Privilege Scrutiny: Why plugins must be audited carefully before installation—since their hooks run on your local machine and their MCP servers spawn local host processes with your full privileges.(Note for listeners: This episode covers Chapter 18 of Sho Shimoda's book RUNNING CLAUDE: The Operator’s Guide to Chat, Cowork and Claude Code, available on Amazon as the successor book to Master Claude: Chat, Cowork and Code).

In Episode 17 of Beyond Prompting, author Sho Shimoda breaks down the Model Context Protocol (MCP)—the open standard that connects Claude Code to external systems like ticket trackers, wikis, and databases. We explore how MCP replaces custom one-off integrations with a universal wire protocol, and examine the major 2026 specification revision. In this episode, we cover:The Three Primitives: Distinguishing between Tools (model-controlled functions), Resources (application-controlled context and documents), and Prompts (user-controlled command templates).The July 2026 Protocol Shift: How the updated MCP specification (2026-07-28) eliminated connection handshakes (initialize) and persistent session IDs (Mcp-Session-Id) in favor of stateless, standalone HTTP POST requests carrying capabilities in _meta.Configuring .mcp.json: Setting up stdio and HTTP transports across local (~/.claude.json), project (.mcp.json), and user scopes, and leveraging tool search (ENABLE_TOOL_SEARCH) to prevent schema overload.Security & Host Access: Why stdio MCP servers run as unconstrained processes on the host machine outside the shell sandbox, and what security teams must verify before connecting third-party servers.(Note for listeners: This episode covers Chapter 17 of Sho Shimoda's book RUNNING CLAUDE: The Operator’s Guide to Chat, Cowork and Claude Code, available on Amazon as the successor book to Master Claude: Chat, Cowork and Code).

In Episode 16 of Beyond Prompting, author Sho Shimoda breaks down how to turn your team's recurring instructions and workflows into executable Agent Skills. Rather than re-explaining multi-step procedures in every new session, Skills allow you to encapsulate standard operating procedures once so Claude can discover and execute them automatically. In this episode, we cover:The Anatomy of a Skill: How a Skill is structured as a directory containing a SKILL.md file with YAML frontmatter and instructions written specifically for an AI agent.The Description Is the Whole Mechanism: Why there are no trigger fields, regex rules, or keyword matchers—Claude decides to invoke a Skill strictly by evaluating its description field against the user's current request.Progressive Loading & Context Economics: How loading works in three cost-effective stages—only descriptions load at session start, the full SKILL.md body loads when invoked, and supporting reference files load only on demand.Executable Procedures with Inline Shell: Leveraging $ARGUMENTS, path variables, and inline shell commands (! prefix) to gather real-time situational facts before Claude begins executing steps.Building Skills That Work: Starting from real organizational repetition, writing intent-focused descriptions, and testing Skills by describing situations naturally rather than explicitly invoking them.(Note for listeners: This episode covers Chapter 16 of Sho Shimoda's book RUNNING CLAUDE: The Operator’s Guide to Chat, Cowork and Claude Code, available on Amazon as the successor book to Master Claude: Chat, Cowork and Code).

In Episode 15 of Beyond Prompting, author Sho Shimoda breaks down prompt caching—the single largest cost lever in the Claude Code ecosystem—and demonstrates how to manage long-term project memory. We explore why two identical sessions can vary dramatically in cost based on how they handle cached context and how to structure state that outlives individual sessions. In this episode, we cover:The Three Cached Layers: How prompt caching organizes context into three ordered layers—system prompt, project context, and conversation—allowing routine turns to run at roughly a tenth of standard input costs by reading cached prefixes.What Discards the Cache: Unintentional actions that invalidate the cached prefix—such as switching models mid-task, changing effort levels, toggling fast mode, or connecting MCP servers on the fly—and how planning session parameters upfront avoids expensive cache rebuilds.Cache Lifetimes (5-Minute vs. 1-Hour TTL): How cache retention periods operate across subscription plans and usage credits, and how to configure TTL settings to match your working rhythm.Durable State Beyond Sessions: Why conversation history is the wrong place to store architectural history, and how to maintain version-controlled decision records (decisions.md) that agents read at session start and update upon completing tasks.(Note for listeners: This episode covers Chapter 15 of Sho Shimoda's book RUNNING CLAUDE: The Operator’s Guide to Chat, Cowork and Claude Code, available on Amazon as the successor book to Master Claude: Chat, Cowork and Code).

In Episode 14 of Beyond Prompting, author Sho Shimoda breaks down how to manage context budgets and session state when conversations run long. We examine the three core mechanisms that control what Claude retains, what gets summarized, and how to recover when an exploration strays off track:Auto Memory Across Sessions: How Claude Code automatically records durable preferences and project facts under ~/.claude/projects/<project>/memory/, loading the top of MEMORY.md while keeping topic-specific files available on demand.Reading the Context Budget: Using the /context command to visualize exact token usage across system prompts, tool definitions, rules, memory, skills, and conversation history.What Compaction Keeps (and Drops): Understanding what survives automatic or manual compaction—system prompts, CLAUDE.md, unscoped rules, plan mode plans, and auto memory are re-injected from disk—and how to direct summaries using /compact focus on <topic>.Going Backwards with Checkpoints: Using /rewind or pressing Esc Esc twice to restore code, conversation, or both across the 100 most recent prompt snapshots, alongside the four structural limits where Git commits remain essential.(Note for listeners: This episode covers Chapter 14 of Sho Shimoda's book RUNNING CLAUDE: The Operator’s Guide to Chat, Cowork and Claude Code, available on Amazon as the successor book to Master Claude: Chat, Cowork and Code).