Level 3 Skills: Tool-Enabled Capabilities
Build Level 3 AI skills that leverage tools for file access, API integration, and system interaction. The gateway to powerful, practical automation.
Level 3 Skills: Tool-Enabled Capabilities
When AI needs to interact with the real world, Level 3 skills step up. These tool-enabled skills can read files, call APIs, access databases, and interact with systems—transforming AI from a text processor into a practical automation engine.
Level 3 represents a significant capability jump. While Level 1 and 2 skills work purely with text, Level 3 skills have hands. They can reach into file systems, query web services, and take actions that have real effects.
In this guide, we will explore how to design, build, and deploy Level 3 tool-enabled skills that safely and effectively bridge AI capabilities with system interactions.
Understanding Level 3 Skills
Level 3 skills occupy the middle of the complexity hierarchy:
| Level | Complexity | Capabilities |
|---|---|---|
| 1 | Minimal | Prompt enhancement: tone, style, vocabulary |
| 2 | Low | Template-based generation with placeholders |
| 3 | Medium | Tool-enabled: file access, APIs, system interaction |
| 4 | High | Multi-agent coordination |
| 5 | Very High | Autonomous workflows |
Core Characteristics
Level 3 skills have defining traits:
Tool Access: Can use tools to interact with systems beyond pure text.
Real Effects: Actions can create, modify, or delete actual resources.
External Data: Can incorporate information from files, APIs, and databases.
Validation Capability: Can verify output by checking against real systems.
Error Handling: Must handle tool failures gracefully.
What Level 3 Skills Do
Tool-enabled capabilities include:
- File Operations: Read, write, search, modify files
- API Integration: Call external services for data or actions
- Database Access: Query and update data stores
- System Commands: Execute shell commands safely
- Web Interaction: Fetch and parse web content
- Search: Find information across sources
What Level 3 Skills Cannot Do
These skills still have limitations:
- Cannot coordinate multiple specialized agents
- Cannot make complex autonomous decisions
- Cannot manage long-running workflows
- Cannot adapt strategy based on results
For these capabilities, you need Level 4 and above.
Available Tools
Level 3 skills leverage various tool types.
File System Tools
## File System Capabilities
### Read Operations
- Read file contents
- List directory contents
- Search files by pattern
- Get file metadata
### Write Operations
- Create new files
- Modify existing files
- Move/rename files
- Delete files (with caution)
### Search Operations
- Glob patterns for file matching
- Grep for content searching
- Recursive directory traversal
### Safety Considerations
- Respect permission boundaries
- Never access sensitive paths
- Validate paths before operations
- Backup before destructive operations
API Tools
## API Capabilities
### HTTP Methods
- GET: Retrieve data
- POST: Submit data
- PUT: Update resources
- DELETE: Remove resources
### Common APIs
- GitHub: Repository operations
- Database: Data queries
- External services: Various integrations
### Safety Considerations
- Use least-privilege credentials
- Validate responses
- Handle rate limits
- Secure sensitive data
System Tools
## System Capabilities
### Command Execution
- Run shell commands
- Capture output
- Handle errors
### Environment
- Read environment variables
- Access configuration
### Safety Considerations
- Whitelist allowed commands
- Sandbox execution
- Validate all inputs
- Limit resource usage
Building Level 3 Skills
Let us create tool-enabled skills step by step.
Example: Codebase Analyzer
---
name: codebase-analyzer
description: Analyzes codebase using file system tools
version: 1.0.0
tools:
- Glob
- Grep
- Read
---
# Codebase Analyzer
Analyze codebases using file system access for comprehensive insights.
## Capabilities
This skill can:
- Search for files by pattern
- Read file contents
- Search for patterns in code
- Aggregate findings
## Workflow
### Step 1: Discovery
Use Glob to find relevant files:
- Source files: `**/*.{js,ts,py,go,rs}`
- Configuration: `**/package.json`, `**/*.config.*`
- Documentation: `**/*.md`, `**/docs/**`
### Step 2: Structure Analysis
For each discovered file type:
- Count files by extension
- Calculate total lines
- Identify primary language
### Step 3: Pattern Search
Use Grep to find:
- TODO comments
- FIXME notes
- Deprecated usage
- Security patterns (passwords, keys)
### Step 4: Content Analysis
Read key files:
- Entry points (index, main, app)
- Configuration files
- README and docs
### Step 5: Synthesis
Combine findings into report:
- Codebase overview
- Language breakdown
- Issues found
- Recommendations
## Tool Usage
### Using Glob
```markdown
Find all TypeScript files:
Pattern: **/*.ts
Path: /project/root
Using Grep
Find TODO comments:
Pattern: TODO|FIXME|HACK
Type: ts
Path: /project/root
Using Read
Read package.json:
File: /project/root/package.json
Output
{
"overview": {
"totalFiles": 150,
"totalLines": 25000,
"primaryLanguage": "TypeScript"
},
"languages": {
"typescript": { "files": 120, "lines": 20000 },
"javascript": { "files": 20, "lines": 3000 },
"json": { "files": 10, "lines": 2000 }
},
"issues": {
"todos": 45,
"fixmes": 12,
"deprecated": 3
},
"insights": [
"Large codebase with good TypeScript coverage",
"45 TODO items suggest pending work",
"No obvious security issues detected"
],
"recommendations": [
"Address FIXME items in priority order",
"Consider TypeScript strict mode",
"Add missing documentation"
]
}
### Example: Dependency Checker
```markdown
---
name: dependency-checker
description: Checks project dependencies for issues
version: 1.0.0
tools:
- Read
- Bash
---
# Dependency Checker
Analyze project dependencies for outdated packages, vulnerabilities, and license issues.
## Capabilities
- Read package manifests
- Check for updates
- Scan for vulnerabilities
- Analyze licenses
## Workflow
### Step 1: Detect Package Manager
Read project files to determine package manager:
- package.json → npm/yarn/pnpm
- requirements.txt → pip
- go.mod → go modules
- Cargo.toml → cargo
### Step 2: Read Dependencies
Parse manifest file to extract:
- Direct dependencies
- Dev dependencies
- Peer dependencies
- Version constraints
### Step 3: Check Updates
For npm projects:
```bash
npm outdated --json
Step 4: Security Scan
For npm projects:
npm audit --json
Step 5: License Analysis
Extract and categorize licenses:
- Permissive: MIT, Apache, BSD
- Copyleft: GPL, LGPL
- Unknown: Needs manual review
Step 6: Generate Report
Compile findings:
- Outdated packages with upgrade paths
- Security vulnerabilities with severity
- License compliance status
Tool Usage
Reading Manifests
Read package.json to extract dependencies:
- dependencies: production deps
- devDependencies: development deps
- peerDependencies: peer requirements
Running Commands
Execute npm audit:
- Capture JSON output
- Parse vulnerabilities
- Map to severity levels
Safety Considerations
Command Safety
- Only run read-only commands
- Never modify package files
- No installation or updates without user consent
Output Safety
- Exclude private package names if needed
- Mask any credential patterns
- Sanitize paths in output
Output
{
"manifest": {
"name": "my-project",
"type": "npm",
"dependencies": 45,
"devDependencies": 20
},
"outdated": [
{
"name": "react",
"current": "17.0.2",
"latest": "18.2.0",
"updateType": "major"
}
],
"vulnerabilities": [
{
"package": "lodash",
"severity": "high",
"title": "Prototype Pollution",
"fixedIn": "4.17.21"
}
],
"licenses": {
"mit": 40,
"apache-2.0": 5,
"unknown": 2
},
"recommendations": [
"Update lodash to fix high-severity vulnerability",
"Consider React 18 migration",
"Review unknown licenses manually"
]
}
## Tool Integration Patterns
Different patterns for using tools effectively.
### Sequential Tool Use
Use tools one after another, each informed by the previous:
```markdown
## Sequential Pattern
### Flow
Tool A → Result A → Tool B (using A) → Result B → Output
### Example: Find and Analyze
1. Glob: Find all test files
2. Read: Read each test file
3. Analyze: Check test coverage patterns
### Benefits
- Simple to reason about
- Clear data flow
- Easy error handling
### Drawbacks
- Slower execution
- No parallelism
Parallel Tool Use
Use multiple tools simultaneously for efficiency:
## Parallel Pattern
### Flow
┌→ Tool A → Result A ─┐
Input ──┼→ Tool B → Result B ─┼→ Merge → Output
└→ Tool C → Result C ─┘
### Example: Multi-Source Search
1. Parallel: Search in src/, lib/, tests/
2. Merge: Combine all results
### Benefits
- Faster execution
- Efficient resource use
### Drawbacks
- More complex error handling
- Merge logic needed
Conditional Tool Use
Choose tools based on context:
## Conditional Pattern
### Flow
Input → Analyze → If X: Tool A, If Y: Tool B → Output
### Example: Language-Specific Analysis
1. Detect: Identify project language
2. If Python: Run python-specific tools
3. If Node: Run node-specific tools
### Benefits
- Appropriate tool for context
- Avoids unnecessary work
### Drawbacks
- Need detection logic
- Multiple tool integrations
Iterative Tool Use
Use tools repeatedly until a condition is met:
## Iterative Pattern
### Flow
Input → Tool → Check → If incomplete: Tool again → Output
### Example: Paginated API
1. Fetch: Get first page
2. Check: More pages?
3. If yes: Fetch next page, append to results
4. Repeat until complete
### Benefits
- Handles unbounded data
- Adaptive to response size
### Drawbacks
- Need termination condition
- Potential for long runs
Error Handling for Tools
Tools can fail—handle gracefully.
Common Failure Modes
## Failure Types
### File System Failures
- File not found
- Permission denied
- Path too long
- Disk full
### API Failures
- Network timeout
- Rate limited
- Authentication failed
- Invalid response
### Command Failures
- Command not found
- Non-zero exit code
- Output parsing error
- Timeout exceeded
Error Handling Strategies
## Handling Strategies
### Retry with Backoff
```typescript
async function withRetry(operation, maxRetries = 3) {
for (let i = 0; i < maxRetries; i++) {
try {
return await operation();
} catch (error) {
if (i === maxRetries - 1) throw error;
await sleep(Math.pow(2, i) * 1000);
}
}
}
Graceful Degradation
If tool fails, continue with partial results:
- Note what failed
- Proceed with available data
- Flag limitations in output
Fallback Operations
If primary tool fails, try alternative:
- npm audit fails → use alternative scanner
- API timeout → use cached data
- File not found → use default
User Notification
When errors affect results:
- Explain what happened
- Describe impact on output
- Suggest remediation
### Error Response Format
```markdown
## Error Output
```json
{
"success": false,
"partialResults": {
"filesAnalyzed": 45,
"issuesFound": 12
},
"errors": [
{
"tool": "npm-audit",
"error": "Command failed with exit code 1",
"impact": "Security scan incomplete",
"workaround": "Run npm audit manually"
}
],
"recommendations": [
"Resolve npm audit issues and retry",
"Check network connectivity"
]
}
## Security Considerations
Tool access requires careful security.
### Permission Boundaries
```markdown
## Access Control
### File System
Allowed:
- Project directory and subdirectories
- Temp directories
- Explicitly allowed paths
Forbidden:
- Home directory hidden files
- System directories
- Other users' files
- Paths with ..
### Commands
Allowed:
- Read-only commands
- Whitelisted commands
- Sandboxed execution
Forbidden:
- Write/delete without confirmation
- Network-accessing commands
- System modification commands
### APIs
Allowed:
- Read operations
- Scoped to project resources
- Rate-limited calls
Forbidden:
- Write without confirmation
- Cross-project access
- Administrative operations
Input Validation
## Validation Rules
### Path Validation
- Normalize paths
- Check for traversal attempts
- Verify within allowed scope
- Resolve symlinks
### Command Validation
- Whitelist commands
- Escape arguments
- Limit argument length
- Block shell injection
### API Validation
- Validate URLs
- Check hostnames
- Verify credentials scope
- Sanitize parameters
Sensitive Data Handling
## Data Protection
### Detection
Identify sensitive patterns:
- API keys: /[a-zA-Z0-9]{32,}/
- Passwords: /password\s*=\s*['"][^'"]+['"]/
- Private keys: /-----BEGIN .* PRIVATE KEY-----/
### Handling
When detected:
- Mask in output
- Warn user
- Never log full values
- Suggest secure alternatives
### Storage
Never store:
- Credentials in plain text
- API keys in code
- Secrets in logs
Testing Level 3 Skills
Tool-enabled skills need rigorous testing.
Test Environment
## Test Setup
### Mock Tools
Create mock implementations:
- Return predefined responses
- Simulate failures
- Track calls for verification
### Test Files
Create test fixtures:
- Sample project structures
- Various file types
- Edge case content
### Isolated Execution
Run tests in isolation:
- Temporary directories
- Clean state each test
- No external dependencies
Test Categories
## Test Suite
### Happy Path
- Tool succeeds
- Expected output generated
- No errors
### Error Handling
- Tool fails gracefully
- Partial results returned
- Clear error messages
### Edge Cases
- Empty directories
- Very large files
- Deep nesting
- Special characters
### Security
- Path traversal blocked
- Sensitive data masked
- Commands validated
### Performance
- Reasonable execution time
- Memory usage bounded
- Handles large inputs
Conclusion
Level 3 tool-enabled skills transform AI from a text-only processor into a practical automation engine. By leveraging file access, APIs, and system interaction, these skills can analyze codebases, check dependencies, validate configurations, and much more.
Key principles for effective Level 3 skills:
- Strategic tool use: Use the right tool for each task
- Robust error handling: Gracefully handle tool failures
- Security first: Validate all inputs, respect boundaries
- Partial success: Return value even when some tools fail
- Clear documentation: Explain what tools are used and why
Start with simple tool integrations—reading a configuration file, searching for patterns. As you gain experience, build more sophisticated skills that combine multiple tools for complex analysis and automation.
Level 3 skills are your gateway to practical AI automation—master them and you will be ready for the multi-agent coordination of Level 4.