[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M7EB6660VAM8D0CMPBDQCZ1P":3,"skill-same:01M7EB6660VAM8D0CMPBDQCZ1P":46},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":24,"commitSha":25,"skillDirectory":26,"forksCount":27,"repositoryHtmlUrl":28,"repositoryHomepageUrl":6,"ownerHtmlUrl":29,"ownerBlogUrl":6,"ownerDescription":30,"updatedAt":31,"install":32,"resources":45},"01M7EB6660VAM8D0CMPBDQCZ1P","artifact-capabilities",null,"Runtime capabilities a published Artifact page can be granted — behavior static HTML cannot provide on its own, such as the page reading live or connected data, remembering what people do on it (a poll, a sign-up sheet, a checklist, a document edited in place — it saves new versions of itself), keeping state shared across viewers, knowing who is viewing, asking Claude a question of its own, storing files people add, or handing the viewer a file to save. Serves this user's live capability roster and the typed call definitions. Load it whenever any such runtime behavior would make an artifact more useful, before writing the page.","lza6\u002FArmor-piercing-system-prompts","lza6","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F128880206?v=4","01M7EB3K7WPX5T28EJ2NVHE6EG","Chinese-tingfeng","01M7EB3K97E1KQ16QWKJMFNGX8",11,"MIT","https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F02-厂商系统提示词\u002Fsystem_prompts_leaks\u002FAnthropic\u002Fclaude-code\u002Fskills\u002Fartifact-capabilities\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: artifact-capabilities\ndescription: |-\n  Runtime capabilities a published Artifact page can be granted — behavior static HTML cannot provide on its own, such as the page reading live or connected data, remembering what people do on it (a poll, a sign-up sheet, a checklist, a document edited in place — it saves new versions of itself), keeping state shared across viewers, knowing who is viewing, asking Claude a question of its own, storing files people add, or handing the viewer a file to save. Serves this user's live capability roster and the typed call definitions. Load it whenever any such runtime behavior would make an artifact more useful, before writing the page.\n---\n\n# Artifact runtime capabilities\n\nA published Artifact page can declare **runtime capabilities** — abilities the claude.ai viewer grants the page at open time — by passing `capabilities: {name: config}` to the Artifact tool. The control plane is the authority on valid names and config shapes. Declaration gestures: **omitting** `capabilities` on a redeploy carries the stored declaration forward unchanged (and preserves the artifact's stored contract pin); an **empty object** `{}` is the explicit clear-all; a **non-empty object** is a full-set declaration (anything stored but not restated is revoked). Moving a republished artifact's runtime version is a deliberate gesture — pass `contract: 'latest'` to upgrade, or a specific version to pin or roll back — never a side effect of editing.\n\n**Available capabilities:** `artifact`, `assets`, `db`, `downloads`, `mcp`, `room`, `sample`, `self` — the complete set of capability names you may declare; built in on every page, called without declaring (never pass these in `capabilities`): `permissions`. Anything not listed is unavailable to this user.\n\nRuntime contract 0.2.46\n\n\nCapability namespaces live behind `claude.use(name)`: `const db = await claude.use(\"db\")` resolves the capability's namespace, or `null` when this view cannot run it (not served, not granted, or failed to load — indistinguishable by design). Branch on `null` and design for absence. `window.claude` carries only `use`: no `window.claude.db`, `.room`, or `.artifact` member is ever promised, so never read one — render the page without them and light features up when the promise resolves (later, never within your script's first run, and unordered with DOMContentLoaded; `null` after 10 s when no viewer answers). The resolved namespace is frozen and platform-owned: call its functions and keep the reference; never assign to it, `defineProperty` on it, or replace a member (wrap it for your own helpers). Permission stays on the calls: a consent prompt, rate limit, or policy refusal arrives on the first call, never from `use()`. Awaiting `use(\"db\")` again is free (memoized); an unknown name resolves `null`.\n\n\n--- capability: artifact ---\n\nUse `artifact` for pages that should remember what people do with them: polls, sign-up sheets, checklists, trackers, boards — the page is the record; data kept server-side, or seeded or read back by Claude, is `db`. Declare `capabilities: {artifact: {}}`; `const artifact = await claude.use(\"artifact\")`, then `await artifact.publish(html)` saves `html` (a complete document, doctype first) as the new version, and every open view, this one included, reloads to it. Nothing a viewer types, ticks or drags is kept unless the page publishes it. So embed the shared state as data in the HTML you publish and render the page from it; when an interaction completes, update the state, regenerate the document and publish it — never serialize the live DOM; batch rapid edits into one publish; publish only after a viewer acts, never on load. `conflict` is routine (every view reloads to the winner, dropping this edit): no retry. For read-only viewers publish rejects `not_granted`\u002F`not_writer` — render a read-only view.\n\n\n--- capability: assets ---\n\n`assets` stores uploaded assets for this artifact: `const assets = await claude.use(\"assets\")`; `await assets.upload(blob)` (image, SVG, video, PDF, font, CSS\u002FJS, or CSV\u002FMarkdown\u002FJSON\u002Ftext data; 20 MiB cap, CSS\u002FJS 16 MiB, SVG 2 MiB and sanitized on upload) resolves `{id, url, sizeBytes, contentType}`; `assets.list()` resolves `{assets, usage}` (storage meter, orphan pruning); `assets.delete(id)` removes one for good: only on a deliberate user action, updating the `db` rows that held the id. Declare `capabilities: {assets: {}}`; a declaring page is organization-internal (never public). Writer-only: a reader view gets `null` from `use(\"assets\")`; hide asset UI on `null` and handle rejection codes. Store the `id` in `db` rows as the durable pointer and index; use the returned `url` as-is as an `\u003Cimg>`\u002F`\u003Cvideo>`\u002F`\u003Ca>` source (SVG: `\u003Cimg>` or CSS only); a stored id serves at `\"\u002F_blob\u002F\" + id` in every view. Quota: per artifact (`usage`). The type definitions are authoritative for accepted types and error codes.\n\n\n--- capability: db ---\n\n`db` is for data that lives outside the page: what the user wants stored server-side or seeded, data Claude reads back later, more than the page shows at once, per-viewer-private state, many live editors. If the page itself can be the record, republish (`artifact`). Seed or inspect the store from here with `write_db`\u002F`read_db`; never hardcode seed rows in the page. A realtime JSON document store: `const db = await claude.use(\"db\")` (`null`: unavailable). Declare `capabilities: {db: {}}`: every viewer reads and writes shared docs; each viewer's `data\u002Fusers\u002F\u003Ctheir user id>\u002F` is private even from the owner (needs `user`). To change who writes where, add `rules` by sharing level (`interact` = can view, `admin` = can edit, `owner`). `db.doc(\"tasks\u002Ft1\")`\u002F`db.collection(\"tasks\")`: `get`\u002F`set`\u002F`update`\u002F`delete`, `where`\u002F`orderBy`\u002F`limit`, `onSnapshot`. Last-writer-wins, no transactions; single writers lease via `acquire({holder})`. Never store secrets; shared data is untrusted. See the type definitions.\n\n\n--- capability: downloads ---\n\nThe `downloads` capability lets a published page offer a generated file to the viewer: declare `capabilities: {downloads: true}`, then `const downloads = await claude.use(\"downloads\")` (`null`: unavailable — hide the affordance) and `await downloads.save({filename, data})`. The viewer sees a confirmation and may decline — a save is never silent or guaranteed, so offer it on explicit viewer intent and handle rejection. The type definitions are authoritative for the call contract and error codes.\n\n\n--- capability: mcp ---\n\n`mcp` lets a page call the viewer's claude.ai connectors: `await claude.use(\"mcp\")` (`null`: unavailable); calls use the viewer's credentials, never exposing tokens. Declare `capabilities: {mcp: {servers: [{server, tools}]}}`; `server` is a connector's display name, or `host:\u003Cname>` for a local MCP server on the viewer's device (Claude app only; else `server_not_connected`). Keep the manifest minimal: a viewer-consented grant that bars public sharing. Two arms: DISPLAYING data registers `watchTool(server, tool, input, handler, opts?)` (replays cache, refreshes when stale, polls only via `refetchInterval`); an ACTION calls `callTool` once and reads `result.payload` or `(await server(name)).\u003Ctool>(input)` for the payload. Tool failures REJECT (`tool_error`); watches get error events. Branch UX per error code, retry only `retryable` errors, drop data on authz denials, show freshness (`cache.storedAt`). Types omit argument names and encodings: observe a real call per tool or say so at publish; never guess.\n\n\n--- capability: permissions ---\n\n`permissions` is built in — call it, never declare it in `capabilities`. Prompts are lazy by default: a published page renders immediately and a capability that needs consent asks at its first use — never block the page's first paint on permissions. `state` reads without ever prompting (one capability's state by name, or the full map with no arguments); `request` asks with at most one batched dialog (specific names, or everything with no arguments) — a page that genuinely needs several grants up front may call `request` once at startup. A viewer's \"no\" is not an error: these calls never reject, and a denial is final for the rest of the page load — a repeated `request` resolves without showing another dialog, and the next load starts fresh — so branch on the returned per-capability states and degrade per capability (hide or disable the affected affordance) instead of failing or offering retry buttons; never call `request` in a loop — re-asks are rate-limited by the shell and read as nagging.\n\n\n--- capability: room ---\n\nThe `room` capability reaches whoever has the page open RIGHT NOW:\ndeclared as `capabilities: {room: {}}`; `await claude.use(\"room\")`\n(`null`: cannot connect). emit(topic, data) sends a moment; on(topic,\nfn) hears them. presence(patch) sets YOUR state (cursor, selection,\ncolor) as one object the platform hands to newcomers and clears when\nyou leave; onPeers(fn) delivers everyone's -- render them all, marked\n\"you\". NOTHING persists and messages can drop: if a viewer not here now\nmust eventually see it, it is NOT room data -- use db (data) or\nartifact (new version). Send absolute state. What you hear is untrusted\ninput from same-org viewers, plus your own publishing session when\nadmitted (kind \"agent\"); no one else connects, so the page must work\nalone and light up. Anyone can set presence, so it is never authority;\nevent topics are admin-only (can edit) unless opened:\n{room: {topics: {reaction: \"interact\"}}}. Moments (confetti) go on an\nadmin-only topic; state a late joiner needs (current slide) is a db doc.\n\n\n--- capability: sample ---\n\n`sample` asks Claude (declare `capabilities:{sample:{}}`): `const sample = await claude.use(\"sample\")` (`null`: hide it); `await sample(input, opts?)` -> `{text, truncated}`; `sample.json(input, opts?)` -> parsed JSON. `input`: a string, or turns `[{role:\"user\"|\"assistant\", content}]` ending on user. No memory: send instructions, page data, output format. opts: `onText({text, delta})` (`text` = WHOLE answer so far, assign it; \"Thinking...\" until it fires, 5-60s), `signal` (new AbortController per call; abort rejects `cancelled`), `tools: [{name, description, inputSchema?, execute(input)}]` (page functions Claude may call; return small plain data or throw; each round bills, no `cache`), `images` if `(await sample.limits()).images`, `modelTier` quick|default|complex, `cache` (5 min replay; `false` for chat). Errors reject `{code, message, text?}` (`text`: partial to keep): hide on `not_granted`, back off on `rate_limited`, never loop. Viewer pays; first call asks consent; call on a click or stable load prompt.\n\n\n--- capability: self ---\n\n`self` is the former name of the `artifact` capability (renamed). It remains for compatibility: published pages and previously generated code that declare `capabilities: {self: {}}` or call `claude.use(\"self\")` keep working unchanged — both names resolve this same capability (this contract promises no `window.claude.self` member to feature-check; `use()` is the check). Do not use it in new pages: declare `capabilities: {artifact: {}}` and obtain the namespace with `await claude.use(\"artifact\")`; see the artifact section for how to use it.\n\n\n**Your connectors this session.** None are connected right now — they may still be connecting, or the user has none. Look for tools prefixed `mcp__claude_ai_*` in your tool list; each is named `mcp__claude_ai_\u003Cconnector>__\u003Ctool>`. Only claude.ai connectors are valid — locally-configured MCP servers are not. The manifest's `tools` array takes the connector's upstream tool names (as returned by `listTools()` \u002F `\u002Fv1\u002Fmcp_servers`), which can differ from the normalized `\u003CtoolName>` segment when an upstream name contains `.` or spaces. Every `servers[]` entry needs a non-empty `tools` array naming the tools the page calls — an empty or omitted `tools` list is refused and never means \"all tools\"; to publish without connector access, leave `mcp` out of `capabilities` (pass `capabilities: {}` to clear a stored declaration) rather than declaring an empty `servers` list. In hermetic\u002FCI sessions where connectors aren't loaded but `$CLAUDE_CODE_OAUTH_TOKEN` is set, fetch the list via Bash: `curl -H 'anthropic-version: 2023-06-01' -H 'anthropic-beta: mcp-servers-2025-12-04' -H \"Authorization: Bearer $CLAUDE_CODE_OAUTH_TOKEN\" https:\u002F\u002Fapi.anthropic.com\u002Fv1\u002Fmcp_servers?limit=1000`; in that case use each entry's `display_name` as the `server` value (exact display names are always accepted alongside tool-prefix segments).\n\n**Call contract** (runtime contract 0.2.46). The platform-served `window.claude` type definitions for this contract are extracted under `the skill directory`: `0.2.46\u002Fartifact.d.ts`, `0.2.46\u002Fassets.d.ts`, `0.2.46\u002Fclaude.d.ts`, `0.2.46\u002Fdb.d.ts`, `0.2.46\u002Fdownloads.d.ts`, `0.2.46\u002Fmcp.d.ts`, `0.2.46\u002Fpermissions.d.ts`, `0.2.46\u002Froom.d.ts`, `0.2.46\u002Fsample.d.ts`, `0.2.46\u002Fself.d.ts`. Read `0.2.46\u002Fclaude.d.ts` (how a page reaches any capability on this contract) and `0.2.46\u002Fmcp.d.ts` before writing any code that calls the `mcp` capability — they are authoritative for this contract version over any remembered API shape. The type definitions cover only the call envelope — they do not tell you a connector tool's argument names or its result encoding. Never publish a page that calls a connector tool without having observed one real request\u002Fresponse pair for that tool in this session; if you cannot safely observe one (for example, the connector is unauthenticated here, or calling the tool would have side effects), say that explicitly to the user at publish time — in your reply, not as a note inside the published page — instead of shipping a guessed shape. Observed response payloads are the user's real data: learn the shape from them, but never embed the observed values in the published page as sample or placeholder data.\n","# Artifact runtime capabilities\n\nA published Artifact page can declare **runtime capabilities** — abilities the claude.ai viewer grants the page at open time — by passing `capabilities: {name: config}` to the Artifact tool. The control plane is the authority on valid names and config shapes. Declaration gestures: **omitting** `capabilities` on a redeploy carries the stored declaration forward unchanged (and preserves the artifact's stored contract pin); an **empty object** `{}` is the explicit clear-all; a **non-empty object** is a full-set declaration (anything stored but not restated is revoked). Moving a republished artifact's runtime version is a deliberate gesture — pass `contract: 'latest'` to upgrade, or a specific version to pin or roll back — never a side effect of editing.\n\n**Available capabilities:** `artifact`, `assets`, `db`, `downloads`, `mcp`, `room`, `sample`, `self` — the complete set of capability names you may declare; built in on every page, called without declaring (never pass these in `capabilities`): `permissions`. Anything not listed is unavailable to this user.\n\nRuntime contract 0.2.46\n\n\nCapability namespaces live behind `claude.use(name)`: `const db = await claude.use(\"db\")` resolves the capability's namespace, or `null` when this view cannot run it (not served, not granted, or failed to load — indistinguishable by design). Branch on `null` and design for absence. `window.claude` carries only `use`: no `window.claude.db`, `.room`, or `.artifact` member is ever promised, so never read one — render the page without them and light features up when the promise resolves (later, never within your script's first run, and unordered with DOMContentLoaded; `null` after 10 s when no viewer answers). The resolved namespace is frozen and platform-owned: call its functions and keep the reference; never assign to it, `defineProperty` on it, or replace a member (wrap it for your own helpers). Permission stays on the calls: a consent prompt, rate limit, or policy refusal arrives on the first call, never from `use()`. Awaiting `use(\"db\")` again is free (memoized); an unknown name resolves `null`.\n\n\n--- capability: artifact ---\n\nUse `artifact` for pages that should remember what people do with them: polls, sign-up sheets, checklists, trackers, boards — the page is the record; data kept server-side, or seeded or read back by Claude, is `db`. Declare `capabilities: {artifact: {}}`; `const artifact = await claude.use(\"artifact\")`, then `await artifact.publish(html)` saves `html` (a complete document, doctype first) as the new version, and every open view, this one included, reloads to it. Nothing a viewer types, ticks or drags is kept unless the page publishes it. So embed the shared state as data in the HTML you publish and render the page from it; when an interaction completes, update the state, regenerate the document and publish it — never serialize the live DOM; batch rapid edits into one publish; publish only after a viewer acts, never on load. `conflict` is routine (every view reloads to the winner, dropping this edit): no retry. For read-only viewers publish rejects `not_granted`\u002F`not_writer` — render a read-only view.\n\n\n--- capability: assets ---\n\n`assets` stores uploaded assets for this artifact: `const assets = await claude.use(\"assets\")`; `await assets.upload(blob)` (image, SVG, video, PDF, font, CSS\u002FJS, or CSV\u002FMarkdown\u002FJSON\u002Ftext data; 20 MiB cap, CSS\u002FJS 16 MiB, SVG 2 MiB and sanitized on upload) resolves `{id, url, sizeBytes, contentType}`; `assets.list()` resolves `{assets, usage}` (storage meter, orphan pruning); `assets.delete(id)` removes one for good: only on a deliberate user action, updating the `db` rows that held the id. Declare `capabilities: {assets: {}}`; a declaring page is organization-internal (never public). Writer-only: a reader view gets `null` from `use(\"assets\")`; hide asset UI on `null` and handle rejection codes. Store the `id` in `db` rows as the durable pointer and index; use the returned `url` as-is as an `\u003Cimg>`\u002F`\u003Cvideo>`\u002F`\u003Ca>` source (SVG: `\u003Cimg>` or CSS only); a stored id serves at `\"\u002F_blob\u002F\" + id` in every view. Quota: per artifact (`usage`). The type definitions are authoritative for accepted types and error codes.\n\n\n--- capability: db ---\n\n`db` is for data that lives outside the page: what the user wants stored server-side or seeded, data Claude reads back later, more than the page shows at once, per-viewer-private state, many live editors. If the page itself can be the record, republish (`artifact`). Seed or inspect the store from here with `write_db`\u002F`read_db`; never hardcode seed rows in the page. A realtime JSON document store: `const db = await claude.use(\"db\")` (`null`: unavailable). Declare `capabilities: {db: {}}`: every viewer reads and writes shared docs; each viewer's `data\u002Fusers\u002F\u003Ctheir user id>\u002F` is private even from the owner (needs `user`). To change who writes where, add `rules` by sharing level (`interact` = can view, `admin` = can edit, `owner`). `db.doc(\"tasks\u002Ft1\")`\u002F`db.collection(\"tasks\")`: `get`\u002F`set`\u002F`update`\u002F`delete`, `where`\u002F`orderBy`\u002F`limit`, `onSnapshot`. Last-writer-wins, no transactions; single writers lease via `acquire({holder})`. Never store secrets; shared data is untrusted. See the type definitions.\n\n\n--- capability: downloads ---\n\nThe `downloads` capability lets a published page offer a generated file to the viewer: declare `capabilities: {downloads: true}`, then `const downloads = await claude.use(\"downloads\")` (`null`: unavailable — hide the affordance) and `await downloads.save({filename, data})`. The viewer sees a confirmation and may decline — a save is never silent or guaranteed, so offer it on explicit viewer intent and handle rejection. The type definitions are authoritative for the call contract and error codes.\n\n\n--- capability: mcp ---\n\n`mcp` lets a page call the viewer's claude.ai connectors: `await claude.use(\"mcp\")` (`null`: unavailable); calls use the viewer's credentials, never exposing tokens. Declare `capabilities: {mcp: {servers: [{server, tools}]}}`; `server` is a connector's display name, or `host:\u003Cname>` for a local MCP server on the viewer's device (Claude app only; else `server_not_connected`). Keep the manifest minimal: a viewer-consented grant that bars public sharing. Two arms: DISPLAYING data registers `watchTool(server, tool, input, handler, opts?)` (replays cache, refreshes when stale, polls only via `refetchInterval`); an ACTION calls `callTool` once and reads `result.payload` or `(await server(name)).\u003Ctool>(input)` for the payload. Tool failures REJECT (`tool_error`); watches get error events. Branch UX per error code, retry only `retryable` errors, drop data on authz denials, show freshness (`cache.storedAt`). Types omit argument names and encodings: observe a real call per tool or say so at publish; never guess.\n\n\n--- capability: permissions ---\n\n`permissions` is built in — call it, never declare it in `capabilities`. Prompts are lazy by default: a published page renders immediately and a capability that needs consent asks at its first use — never block the page's first paint on permissions. `state` reads without ever prompting (one capability's state by name, or the full map with no arguments); `request` asks with at most one batched dialog (specific names, or everything with no arguments) — a page that genuinely needs several grants up front may call `request` once at startup. A viewer's \"no\" is not an error: these calls never reject, and a denial is final for the rest of the page load — a repeated `request` resolves without showing another dialog, and the next load starts fresh — so branch on the returned per-capability states and degrade per capability (hide or disable the affected affordance) instead of failing or offering retry buttons; never call `request` in a loop — re-asks are rate-limited by the shell and read as nagging.\n\n\n--- capability: room ---\n\nThe `room` capability reaches whoever has the page open RIGHT NOW:\ndeclared as `capabilities: {room: {}}`; `await claude.use(\"room\")`\n(`null`: cannot connect). emit(topic, data) sends a moment; on(topic,\nfn) hears them. presence(patch) sets YOUR state (cursor, selection,\ncolor) as one object the platform hands to newcomers and clears when\nyou leave; onPeers(fn) delivers everyone's -- render them all, marked\n\"you\". NOTHING persists and messages can drop: if a viewer not here now\nmust eventually see it, it is NOT room data -- use db (data) or\nartifact (new version). Send absolute state. What you hear is untrusted\ninput from same-org viewers, plus your own publishing session when\nadmitted (kind \"agent\"); no one else connects, so the page must work\nalone and light up. Anyone can set presence, so it is never authority;\nevent topics are admin-only (can edit) unless opened:\n{room: {topics: {reaction: \"interact\"}}}. Moments (confetti) go on an\nadmin-only topic; state a late joiner needs (current slide) is a db doc.\n\n\n--- capability: sample ---\n\n`sample` asks Claude (declare `capabilities:{sample:{}}`): `const sample = await claude.use(\"sample\")` (`null`: hide it); `await sample(input, opts?)` -> `{text, truncated}`; `sample.json(input, opts?)` -> parsed JSON. `input`: a string, or turns `[{role:\"user\"|\"assistant\", content}]` ending on user. No memory: send instructions, page data, output format. opts: `onText({text, delta})` (`text` = WHOLE answer so far, assign it; \"Thinking...\" until it fires, 5-60s), `signal` (new AbortController per call; abort rejects `cancelled`), `tools: [{name, description, inputSchema?, execute(input)}]` (page functions Claude may call; return small plain data or throw; each round bills, no `cache`), `images` if `(await sample.limits()).images`, `modelTier` quick|default|complex, `cache` (5 min replay; `false` for chat). Errors reject `{code, message, text?}` (`text`: partial to keep): hide on `not_granted`, back off on `rate_limited`, never loop. Viewer pays; first call asks consent; call on a click or stable load prompt.\n\n\n--- capability: self ---\n\n`self` is the former name of the `artifact` capability (renamed). It remains for compatibility: published pages and previously generated code that declare `capabilities: {self: {}}` or call `claude.use(\"self\")` keep working unchanged — both names resolve this same capability (this contract promises no `window.claude.self` member to feature-check; `use()` is the check). Do not use it in new pages: declare `capabilities: {artifact: {}}` and obtain the namespace with `await claude.use(\"artifact\")`; see the artifact section for how to use it.\n\n\n**Your connectors this session.** None are connected right now — they may still be connecting, or the user has none. Look for tools prefixed `mcp__claude_ai_*` in your tool list; each is named `mcp__claude_ai_\u003Cconnector>__\u003Ctool>`. Only claude.ai connectors are valid — locally-configured MCP servers are not. The manifest's `tools` array takes the connector's upstream tool names (as returned by `listTools()` \u002F `\u002Fv1\u002Fmcp_servers`), which can differ from the normalized `\u003CtoolName>` segment when an upstream name contains `.` or spaces. Every `servers[]` entry needs a non-empty `tools` array naming the tools the page calls — an empty or omitted `tools` list is refused and never means \"all tools\"; to publish without connector access, leave `mcp` out of `capabilities` (pass `capabilities: {}` to clear a stored declaration) rather than declaring an empty `servers` list. In hermetic\u002FCI sessions where connectors aren't loaded but `$CLAUDE_CODE_OAUTH_TOKEN` is set, fetch the list via Bash: `curl -H 'anthropic-version: 2023-06-01' -H 'anthropic-beta: mcp-servers-2025-12-04' -H \"Authorization: Bearer $CLAUDE_CODE_OAUTH_TOKEN\" https:\u002F\u002Fapi.anthropic.com\u002Fv1\u002Fmcp_servers?limit=1000`; in that case use each entry's `display_name` as the `server` value (exact display names are always accepted alongside tool-prefix segments).\n\n**Call contract** (runtime contract 0.2.46). The platform-served `window.claude` type definitions for this contract are extracted under `the skill directory`: `0.2.46\u002Fartifact.d.ts`, `0.2.46\u002Fassets.d.ts`, `0.2.46\u002Fclaude.d.ts`, `0.2.46\u002Fdb.d.ts`, `0.2.46\u002Fdownloads.d.ts`, `0.2.46\u002Fmcp.d.ts`, `0.2.46\u002Fpermissions.d.ts`, `0.2.46\u002Froom.d.ts`, `0.2.46\u002Fsample.d.ts`, `0.2.46\u002Fself.d.ts`. Read `0.2.46\u002Fclaude.d.ts` (how a page reaches any capability on this contract) and `0.2.46\u002Fmcp.d.ts` before writing any code that calls the `mcp` capability — they are authoritative for this contract version over any remembered API shape. The type definitions cover only the call envelope — they do not tell you a connector tool's argument names or its result encoding. Never publish a page that calls a connector tool without having observed one real request\u002Fresponse pair for that tool in this session; if you cannot safely observe one (for example, the connector is unauthenticated here, or calling the tool would have side effects), say that explicitly to the user at publish time — in your reply, not as a note inside the published page — instead of shipping a guessed shape. Observed response payloads are the user's real data: learn the shape from them, but never embed the observed values in the published page as sample or placeholder data.\n",{"name":5,"description":7},"main","d69096e239f2a89aabc2cd078c47664a9d3b1e11","02-厂商系统提示词\u002Fsystem_prompts_leaks\u002FAnthropic\u002Fclaude-code\u002Fskills\u002Fartifact-capabilities",3,"https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts","https:\u002F\u002Fgithub.com\u002Flza6","个人vx：Tf00798\r\n个人✈：@TFGY999","2026-10-08 14:29:22",{"source":8,"skillName":5,"commands":33,"prompt":43,"zipAvailable":44},[34,37,40],{"tool":35,"command":36},"npx","npx skills add lza6\u002FArmor-piercing-system-prompts --skill artifact-capabilities",{"tool":38,"command":39},"bunx","bunx skills add lza6\u002FArmor-piercing-system-prompts --skill artifact-capabilities",{"tool":41,"command":42},"pnpm","pnpm dlx skills add lza6\u002FArmor-piercing-system-prompts --skill artifact-capabilities","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F02-厂商系统提示词\u002Fsystem_prompts_leaks\u002FAnthropic\u002Fclaude-code\u002Fskills\u002Fartifact-capabilities\u002FSKILL.md",true,[],[47,54,61,68,76,83],{"skillNo":48,"name":49,"nameZh":6,"description":50,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":51,"categories":52,"keywords":53,"publishedAt":19},"01M7EXRM12046G0GM1WGMMFXCN","ci-cd-and-automation","Automates CI\u002FCD pipeline setup. Use when setting up or modifying build and deployment pipelines. Use when you need to automate quality gates, configure test runners in CI, or establish deployment strategies.","https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F05-技能与代理开发\u002Fci-cd-and-automation\u002FSKILL.md",[],[],{"skillNo":55,"name":56,"nameZh":6,"description":57,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":58,"categories":59,"keywords":60,"publishedAt":19},"01M7EXRFYYSJ3Y15AGPDDEWWQD","chrome-devtools","Uses Chrome DevTools via MCP for efficient debugging, troubleshooting and browser automation. Use when debugging web pages, automating browser interactions, analyzing performance, or inspecting network requests. This skill does not apply to `--slim` mode (MCP configuration).","https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F05-技能与代理开发\u002Fchrome-devtools\u002FSKILL.md",[],[],{"skillNo":62,"name":63,"nameZh":6,"description":64,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":65,"categories":66,"keywords":67,"publishedAt":19},"01M7EXR6EYPE4X5X1BTAE6QJRV","chrome-cdp","Drive a real Chrome via the Chrome DevTools Protocol (CDP). Ensures a\ndebuggable Chrome is running (launching it if needed) so the agent can\nnavigate, read page content, inspect the DOM, run JavaScript, and take\nscreenshots — without the user typing any launch command. Includes a\nfirst-class \"review a live running app\" flow: point Chrome at the app under\ndevelopment and inspect\u002Fscreenshot the REAL page (what a static-artifact tool\ncannot do). Backed by Glimpse and the chrome-devtools MCP server. Use when\nasked to \"use chrome\", \"open chrome\", \"drive my browser\", \"read the page in\nchrome\", \"review the running app\", \"screenshot the app\", or \"\u002Fchrome-cdp\".","https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F05-技能与代理开发\u002Fchrome-cdp\u002FSKILL.md",[],[],{"skillNo":69,"name":70,"nameZh":6,"description":71,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":72,"licenseFileUrl":6,"sourceHtmlUrl":73,"categories":74,"keywords":75,"publishedAt":19},"01M7EXR1Y7E79KQKG4J798XGH6","check-identity-pack","Run an AFP 100-point or AUSTRAC safe-harbour identity check over a set of documents, and report exactly what's missing. Use when the user asks to check identity documents, verify someone's ID for onboarding, or assess whether a document pack satisfies Australian identity requirements.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F05-技能与代理开发\u002Fcheck-identity-pack\u002FSKILL.md",[],[],{"skillNo":77,"name":78,"nameZh":6,"description":79,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":80,"categories":81,"keywords":82,"publishedAt":19},"01M7EXQXW7C7PGREJW9ZZTZ16H","changelog","Auto-generates a changelog from git commits, sprint data, and design documents. Produces both internal and player-facing versions.","https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F05-技能与代理开发\u002Fchangelog\u002FSKILL.md",[],[],{"skillNo":84,"name":85,"nameZh":6,"description":86,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":87,"categories":88,"keywords":89,"publishedAt":19},"01M7EXQMH2ZME3ANN8Q8MEWPFB","cellxgene-census","Query the CZ CELLxGENE Census programmatically for versioned public single-cell and spatial transcriptomics data. Use when you need population-scale cell metadata, gene expression slices, Census summary counts, source H5AD URIs\u002Fdownloads, embeddings, spatial Census data, or reference atlas comparisons across organisms, tissues, diseases, assays, and cell types. For analyzing your own local single-cell data use scanpy, anndata, or scvi-tools.","https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F05-技能与代理开发\u002Fcellxgene-census\u002FSKILL.md",[],[]]