Skills: Skill Anatomy: Prompt + Tool + Trigger
Last updated: 2026-08-31
See through the skeleton of a Skill — prompts are the brain, tools are the hands, triggers are the nerves.
1. Three Components Overview
A complete Skill consists of three core components:
graph LR
A[Trigger] -->|Activates| B[Prompt]
B -->|Guides| C[Tools]
C -->|Executes| D[Output Result]
D -->|Feeds back| B
| Component | Purpose | Analogy |
|---|---|---|
| Prompt | Defines AI behavior norms and output format | Brain — decides "how to think" |
| Tool | Provides AI's ability to interact with the outside | Hands — decides "what can be done" |
| Trigger | Controls when to activate the Skill | Nerves — decides "when to react" |
2. Prompt Deep Dive
(1) Prompt Structure
A high-quality prompt includes these layers:
TEXT
📖 Display only
Prompt Structure
├── Role Definition (who you are)
├── Task Description (what to do)
├── Execution Flow (how to do it)
├── Constraints (what not to do)
├── Output Format (what the output looks like)
└── Examples (reference samples)
(2) Role Definition
MARKDOWN
# Role Definition Example
You are a senior DevOps engineer, specializing in Kubernetes and CI/CD pipeline design.
Your expertise includes:
- Containerized deployment and orchestration
- GitHub Actions / GitLab CI configuration
- Production monitoring and alerting
(3) Execution Flow
MARKDOWN
# Execution Flow Example
Follow these steps to perform a deployment check:
1. Read the Dockerfile, verify base image version
2. Check CI configuration file, confirm pipeline steps
3. Search for hardcoded environment variables and secrets
4. Verify health check endpoint configuration
5. Output check report
(4) Output Format Constraints
MARKDOWN
# Output Format
Use the following format for check results:
| Check Item | Status | Details |
|:-----------|:-------|:--------|
| Base Image | ✅/⚠️/❌ | Version and suggestions |
| CI Steps | ✅/⚠️/❌ | Missing steps |
| Sensitive Info | ✅/⚠️/❌ | Found location |
| Health Check | ✅/⚠️/❌ | Configuration suggestions |
3. Tool Bindings Deep Dive
(1) Tool Categories
| Category | Tool | Purpose |
|---|---|---|
| File Read | Read | Read file contents |
| File Write | Write, Edit | Create or modify files |
| Code Search | Grep, Glob | Search code patterns |
| Command Execution | Bash | Run Shell commands |
| Web Requests | WebFetch | Fetch web content |
| MCP Tools | Custom | Connect external services |
(2) Tool Selection Principles
TEXT
📖 Display only
Principle of Least Privilege:
- Read-only task → Only bind Read
- Need search → Add Grep/Glob
- Need modification → Add Edit (not Write, safer)
- Need execution → Add Bash (highest privilege, use with caution)
(3) Tool Binding Examples
YAML
# Read-only review — safest
tools:
- Read
- Grep
- Glob
# Code fix — needs edit permission
tools:
- Read
- Edit
- Bash
# Full deployment — highest privilege
tools:
- Read
- Write
- Edit
- Bash
- WebFetch
4. Triggers Deep Dive
(1) Trigger Types
| Type | Syntax | Description |
|---|---|---|
| Keyword | keyword: "review" |
Matches keywords in user input |
| File Pattern | file_pattern: "**/*.py" |
Matches file types being operated on |
| Context Condition | context: "git_diff" |
Matches current environment state |
| Combined | any_of / all_of |
Multi-condition logical combination |
(2) Keyword Triggers
YAML
triggers:
- keyword: "review|code review"
- keyword: "deploy"
(3) File Pattern Triggers
YAML
triggers:
- file_pattern: "**/*.py"
- file_pattern: "**/Dockerfile"
(4) Combined Triggers
YAML
triggers:
- all_of:
- keyword: "review"
- file_pattern: "src/**/*.ts"
5. Three Components Working Together
▶ Example: Security Audit Skill
YAML
---
name: security-audit
description: "Security audit skill, checking code for security vulnerabilities"
triggers:
- keyword: "security|security audit|vulnerability check"
- file_pattern: "**/*.{py,js,ts,go,java}"
tools:
- Read
- Grep
- Glob
---
# Security Audit Skill
## Role
You are a security audit expert, focused on OWASP Top 10 vulnerability detection.
## Execution Flow
1. Use Glob to determine project tech stack
2. Use Grep to search for common vulnerability patterns (SQL concatenation, eval, hardcoded keys)
3. Use Read to inspect suspicious files in detail
4. Output vulnerability report
## Checklist
- [ ] SQL Injection
- [ ] Cross-Site Scripting (XSS)
- [ ] Hardcoded keys/passwords
- [ ] Insecure deserialization
- [ ] Path traversal
- [ ] Command injection
## Output Format
For each vulnerability output: severity, location, description, fix suggestion
Alice used this Skill to discover 3 previously unnoticed security vulnerabilities in the project. Bob said: "The synergy between tools and prompts is key — Grep does initial scanning, Read does deep confirmation, and prompts ensure nothing is missed."
❓ FAQ
Q Which of the three components is most important?
A Prompts are the core — they determine the quality ceiling of a Skill. Tools determine capability boundaries; triggers determine convenience. Without good prompts, even many tools won't be used well.
Q How many triggers should I set?
A 1-3 is enough. Too many triggers cause false activations; too few make it hard to activate. Keyword triggers are most commonly used; file pattern triggers suit automation scenarios.
Q What if AI doesn't use a bound tool?
A Explicitly require tool usage in the prompt and provide specific invocation steps. For example, "Use the Read tool to read the file" is more explicit than "look at the file."
📖 Summary
- Three Skill components: Prompt (brain), Tool (hands), Trigger (nerves)
- Prompt structure: Role → Task → Flow → Constraints → Format → Examples
- Tool selection follows the principle of least privilege
- Trigger types: keyword, file pattern, context condition, combined logic
📝 Exercises
- Basic (⭐): Analyze your previously created Skill and check if all three components are complete.
- Intermediate (⭐⭐): Create a "performance optimization" Skill with appropriate prompts, tool bindings, and triggers.
- Advanced (⭐⭐⭐): Design a Skill with combined triggers that only activates when a specific file type and specific keyword appear together.
