Claude AI DevOps Agents Prompt Engineering

Claude Code Workflow Cheatsheet: CLAUDE.md, Skills, and Hooks

Q: Getting started: install and /init

/init drafts a starter CLAUDE.md from what it can infer from the codebase — the gotchas it can't see, like secrets locations and flaky tests, still need a human to write them in.

Q: Four layers and the daily workflow

One feature per session with frequent commits keeps /compact cheap — a session that spans several features accumulates noise the four-layer stack (memory, skills, hooks, agents) can't offset.

Core Concept LearningJuly 16, 20265 min readUpdated July 21, 2026

Claude Code is a terminal coding agent — useful only when the repo teaches it how you work. That teaching lives in CLAUDE.md, layered memory files, skills, hooks, permissions, and optional subagents.

This cheatsheet is a practical 2026 workflow: install and /init, shape memory, add skills/hooks safely, then a daily plan → implement → compact loop. Surfaces reflect public Claude Code docs as of July 2026; re-check hooks and permissions before rollout. For skill ideas across domains see Claude Skills Map; for the capability ladder see From LLM to Agentic AI.

Running example: a Next.js app where Claude knows npm run dev, App Router layout, and never reads .env.

Claude Code stack: memory → skills → hooks → agents

Learning path

Follow these checkpoints in order — each builds on the last.

/init drafts a starter CLAUDE.md from what it can infer from the codebase — the gotchas it can't see, like secrets locations and flaky tests, still need a human to write them in.
What / Why / How structures CLAUDE.md as commands and boundaries an agent actually needs — a 2,000-line repo dump fights the context window instead of teaching it anything.
Global and ancestor CLAUDE.md files load at launch, but a nested ./frontend/CLAUDE.md loads only when that subtree is actually touched — and files add context rather than reliably overriding each other, so contradictions stay ambiguous.
A skill's description field is what enables auto-activation from natural language — twenty empty stubs with vague descriptions never fire; two skills run weekly with sharp descriptions do.
Exit 2 only blocks the events documented as blockable — checking the hook event table before treating a script as a policy gate is what tells apart a real deny from one that silently continues.
One feature per session with frequent commits keeps /compact cheap — a session that spans several features accumulates noise the four-layer stack (memory, skills, hooks, agents) can't offset.

Getting started: install and /init

Install Claude Code (Node 18+), then open a project and bootstrap memory. A typical path: run the official install script, cd into the repo, start claude, and run /init so it scans the codebase and creates a starter memory file.

When to use /init: every new repo before long sessions. When not to: skipping init and dumping a 2,000-line dump into chat — prefer curated CLAUDE.md.

Bootstrap: install → cd project → claude → /init

Quick reference

Install via the official Claude install script (Node 18+).
cd into the project → claude → /init.
/init drafts CLAUDE.md from what it can infer.
You still edit gotchas Claude cannot see (secrets locations, flaky tests).

Remember this

/init drafts a starter CLAUDE.md from what it can infer from the codebase — the gotchas it can't see, like secrets locations and flaky tests, still need a human to write them in.

CLAUDE.md: what, why, and how

CLAUDE.md is persistent project memory — loaded automatically. Structure it as What (stack, directory map, architecture), Why (module purpose, design decisions), and How (build/test/lint commands, workflows, gotchas).

Example notes: npm run dev for local, /app for Next.js App Router. Keep it specific; reference files with @filename when useful.

Best practices: run /init first, add gotchas Claude cannot infer, stay concise, never paste secrets.

CLAUDE.md = What · Why · How (persistent project memory)

Quick reference

What: tech stack, dirs, architecture.
Why: purpose and design decisions per module.
How: commands, workflows, known pitfalls.
Be specific; prefer short bullets over essays.

Remember this

What / Why / How structures CLAUDE.md as commands and boundaries an agent actually needs — a 2,000-line repo dump fights the context window instead of teaching it anything.

Memory file hierarchy

Memory stacks in tiers: Global ~/.claude/CLAUDE.md, ancestor directories, and the current working directory load at launch. A nested file such as ./frontend/CLAUDE.md loads on demand when Claude reads files in that subtree, rather than all nested files loading up front. The files contribute additive context; contradictory instructions are ambiguous, so do not rely on a simple override rule.

Keep each file roughly under ~200 lines. Long files fight the context window and confuse priorities.

Memory tiers: global → parent → project → subfolder

Quick reference

Global + ancestors + working directory load at launch; child-directory files load when that subtree is accessed.
Commit project CLAUDE.md; keep personal prefs in ~/.claude.
Add scoped context without contradicting parent safety rules; conflict resolution is not a guaranteed override mechanism.
Trim ruthlessly — under ~200 lines per file.

Remember this

Global and ancestor CLAUDE.md files load at launch, but a nested ./frontend/CLAUDE.md loads only when that subtree is actually touched — and files add context rather than reliably overriding each other, so contradictions stay ambiguous.

Project layout, skills, and skill ideas

Typical layout: root CLAUDE.md, .claude/settings.json (+ local overrides), skills/, commands/ (e.g. deploy.md), agents/, plus src/ and .gitignore.

Skills are markdown guides Claude auto-invokes from natural language. Project skills live in .claude/skills/; personal in ~/.claude/skills/. A clear description field is what enables auto-activation.

Useful engineer skills: code-review, testing patterns, commit messages, docker-deploy, codebase visualizer, API design.

Skills live in .claude/skills — description drives auto-invoke

Quick reference

.claude/ holds settings, skills, commands, agents.
Skills = auto-invoked know-how packs.
Description field matters for matching.
Start with two skills you run weekly — not twenty empty stubs.

code-reviewtestingcommit-messagesdocker-deployapi-design

Remember this

A skill's description field is what enables auto-activation from natural language — twenty empty stubs with vague descriptions never fire; two skills run weekly with sharp descriptions do.

Hooks, permissions, and safety

Hooks are deterministic callbacks such as PreToolUse, PostToolUse, and Notification. Exit-code behavior is event-specific: exit 2 blocks PreToolUse, while non-blocking events such as Notification continue and surface the error. Check the hook event table before treating a script as a policy gate. These examples were checked against Claude Code 2.1.210 and the official docs on 2026-07-17.

Permissions allow safe defaults and deny dangerous paths. Prefer explicit secret-path denies even if CLAUDE.md says “be careful.”

One Read(.env) zoom: PreToolUse runs, exit 2 blocks, secrets stay unread

Quick reference

PreToolUse / PostToolUse / Notification hooks.
Exit 0 reports no objection; exit 2 blocks only events documented as blockable.
Allow: reads, git, markdown writes as needed.
Deny: .env* and privileged shell (sudo).

Remember this

Exit 2 only blocks the events documented as blockable — checking the hook event table before treating a script as a policy gate is what tells apart a real deny from one that silently continues.

Four layers and the daily workflow

Architecture stack: L1 CLAUDE.md (persistent rules) → L2 Skills (auto knowledge) → L3 Hooks (safety/automation) → L4 Agents (subagents with their own context).

Daily pattern: cd + claude → enter Plan Mode → describe intent → Auto Accept when ready → /compact to clean context → Esc Esc to rewind → commit often and start a new session per feature.

Quick commands: /init, /compact, Shift+Tab for modes, Tab for extended thinking, Esc Esc for rewind. (Exact keybindings can vary by version — check /help in your install.)

Daily: Plan → implement → compact → commit · new session per feature

Quick reference

L1 memory → L2 skills → L3 hooks → L4 agents.
Plan before auto-accept on large changes.
/compact when context gets noisy.
One feature ≈ one session; commit frequently.

Remember this

One feature per session with frequent commits keeps /compact cheap — a session that spans several features accumulates noise the four-layer stack (memory, skills, hooks, agents) can't offset.

Key takeaway

Claude Code compounds when memory, skills, hooks, and permissions are deliberate — not when you paste the whole repo into chat. Start with /init, trim CLAUDE.md, add two skills and one PreToolUse safety hook, then practice the plan/auto-accept/compact loop.

Practice (25 min): In a real or scratch repo, run /init, reduce CLAUDE.md to the commands and boundaries the agent needs, deny .env*, and add one invokable skill. The expected result is a planned change that uses the documented test command without reading secrets. Intentionally ask the agent to inspect .env; recover by keeping the denial in place and supplying a safe .env.example or explicit variable names instead. Pass when the normal task completes, the secret read produces a visible denial, and a fresh session can follow the same repository instructions.