> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cantina.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Skills

> Reusable playbooks that teach agents how to handle specific classes of tasks to a known standard.

> Reusable playbooks that teach agents how to handle specific classes of tasks to a known standard.
> A skill is a reusable playbook that teaches the agent how to perform a specific class of tasks to a known standard, along with the tools available to investigate and remediate security alerts.
>
> Agents use skills to make decisions during triage. Updating a skill is how you change agent behavior.

## What a skill contains

* **Content**: Rich procedural text describing the playbook, with headings, lists, links, and embedded tools.
* **Tools**: Integrations the skill can invoke during execution, including Slack, Teams, Discord, SMS, email, PagerDuty, webhook, DNS, Jira, AWS, Vercel, Huntress, CrowdStrike, plus custom MCP tools.
* **Domain tags**: Categories like DNS, Identity & Access, Onchain, Cloud, SDLC.
* **Versions**: Every save creates a snapshot with editor attribution. Compare and roll back as needed.
* **Lineage**: Skills can be **managed** (synced from a template) or **unmanaged** (forked or custom). Editing a managed skill forks it.

## Skill templates

Clarion ships a curated library for common scenarios:

* **DNS**: Unauthorized record changes, dangling subdomain remediation, NS hijack response.
* **Identity & Access**: Okta policy weakened, suspicious sign-in, MFA bypass, privilege escalation.
* **Onchain**: Smart contract exploit triage, emergency pause coordination, on-chain anomaly review.
* **Cloud**: IAM access key compromise, GuardDuty finding investigation, CloudTrail anomaly.
* **SDLC**: Leaked secret response, suspicious GitHub access, build pipeline tampering.

## Workspace-level instructions

Skills describe how to handle a specific class of tasks. For guidance that should apply across **every** agent in your workspace, use workspace-level instructions in [Workspace settings](/clarion/learn/settings#workspace) instead of duplicating it in each skill.

Use workspace instructions to configure behavior across all agents in this workspace. Good examples:

* Where to send notifications by default.
* How to start a war room.
* Organization-wide terminology, escalation hierarchy, and on-call conventions.

## What you can do

* **Create** skills from a template or from scratch.
* **Edit** skill content with full version history.
* **Embed tools** in a skill to give agents the actions they need.
* **Assign** skills to agents.
* **Fork** templates on customization, or **reset** back to the template default.

[Learn about Tools →](/clarion/learn/tools)