Level 3 Skills: Tool-Enabled Capabilities

When AI needs to interact with the real world, Level 3 skills step up. These tool-enabled skills can read files, call APIs, access databases, and interact with systems—transforming AI from a text processor into a practical automation engine.

Level 3 represents a significant capability jump. While Level 1 and 2 skills work purely with text, Level 3 skills have hands. They can reach into file systems, query web services, and take actions that have real effects.

In this guide, we will explore how to design, build, and deploy Level 3 tool-enabled skills that safely and effectively bridge AI capabilities with system interactions.

Understanding Level 3 Skills

Level 3 skills occupy the middle of the complexity hierarchy:

Level	Complexity	Capabilities
1	Minimal	Prompt enhancement: tone, style, vocabulary
2	Low	Template-based generation with placeholders
3	Medium	Tool-enabled: file access, APIs, system interaction
4	High	Multi-agent coordination
5	Very High	Autonomous workflows

Core Characteristics

Level 3 skills have defining traits:

Tool Access: Can use tools to interact with systems beyond pure text.

Real Effects: Actions can create, modify, or delete actual resources.

External Data: Can incorporate information from files, APIs, and databases.

Validation Capability: Can verify output by checking against real systems.

Error Handling: Must handle tool failures gracefully.

What Level 3 Skills Do

Tool-enabled capabilities include:

File Operations: Read, write, search, modify files
API Integration: Call external services for data or actions
Database Access: Query and update data stores
System Commands: Execute shell commands safely
Web Interaction: Fetch and parse web content
Search: Find information across sources

What Level 3 Skills Cannot Do

These skills still have limitations:

Cannot coordinate multiple specialized agents
Cannot make complex autonomous decisions
Cannot manage long-running workflows
Cannot adapt strategy based on results

For these capabilities, you need Level 4 and above.

Available Tools

Level 3 skills leverage various tool types.

File System Tools

## File System Capabilities

### Read Operations
- Read file contents
- List directory contents
- Search files by pattern
- Get file metadata

### Write Operations
- Create new files
- Modify existing files
- Move/rename files
- Delete files (with caution)

### Search Operations
- Glob patterns for file matching
- Grep for content searching
- Recursive directory traversal

### Safety Considerations
- Respect permission boundaries
- Never access sensitive paths
- Validate paths before operations
- Backup before destructive operations

API Tools

## API Capabilities

### HTTP Methods
- GET: Retrieve data
- POST: Submit data
- PUT: Update resources
- DELETE: Remove resources

### Common APIs
- GitHub: Repository operations
- Database: Data queries
- External services: Various integrations

### Safety Considerations
- Use least-privilege credentials
- Validate responses
- Handle rate limits
- Secure sensitive data

System Tools

## System Capabilities

### Command Execution
- Run shell commands
- Capture output
- Handle errors

### Environment
- Read environment variables
- Access configuration

### Safety Considerations
- Whitelist allowed commands
- Sandbox execution
- Validate all inputs
- Limit resource usage

Building Level 3 Skills

Let us create tool-enabled skills step by step.

Example: Codebase Analyzer

---
name: codebase-analyzer
description: Analyzes codebase using file system tools
version: 1.0.0
tools:
  - Glob
  - Grep
  - Read
---

# Codebase Analyzer

Analyze codebases using file system access for comprehensive insights.

## Capabilities

This skill can:
- Search for files by pattern
- Read file contents
- Search for patterns in code
- Aggregate findings

## Workflow

### Step 1: Discovery
Use Glob to find relevant files:
- Source files: `**/*.{js,ts,py,go,rs}`
- Configuration: `**/package.json`, `**/*.config.*`
- Documentation: `**/*.md`, `**/docs/**`

### Step 2: Structure Analysis
For each discovered file type:
- Count files by extension
- Calculate total lines
- Identify primary language

### Step 3: Pattern Search
Use Grep to find:
- TODO comments
- FIXME notes
- Deprecated usage
- Security patterns (passwords, keys)

### Step 4: Content Analysis
Read key files:
- Entry points (index, main, app)
- Configuration files
- README and docs

### Step 5: Synthesis
Combine findings into report:
- Codebase overview
- Language breakdown
- Issues found
- Recommendations

## Tool Usage

### Using Glob
```markdown
Find all TypeScript files:
Pattern: **/*.ts
Path: /project/root

Using Grep

Find TODO comments:
Pattern: TODO|FIXME|HACK
Type: ts
Path: /project/root

Using Read

Read package.json:
File: /project/root/package.json

Output

{
  "overview": {
    "totalFiles": 150,
    "totalLines": 25000,
    "primaryLanguage": "TypeScript"
  },
  "languages": {
    "typescript": { "files": 120, "lines": 20000 },
    "javascript": { "files": 20, "lines": 3000 },
    "json": { "files": 10, "lines": 2000 }
  },
  "issues": {
    "todos": 45,
    "fixmes": 12,
    "deprecated": 3
  },
  "insights": [
    "Large codebase with good TypeScript coverage",
    "45 TODO items suggest pending work",
    "No obvious security issues detected"
  ],
  "recommendations": [
    "Address FIXME items in priority order",
    "Consider TypeScript strict mode",
    "Add missing documentation"
  ]
}


### Example: Dependency Checker

```markdown
---
name: dependency-checker
description: Checks project dependencies for issues
version: 1.0.0
tools:
  - Read
  - Bash
---

# Dependency Checker

Analyze project dependencies for outdated packages, vulnerabilities, and license issues.

## Capabilities

- Read package manifests
- Check for updates
- Scan for vulnerabilities
- Analyze licenses

## Workflow

### Step 1: Detect Package Manager
Read project files to determine package manager:
- package.json → npm/yarn/pnpm
- requirements.txt → pip
- go.mod → go modules
- Cargo.toml → cargo

### Step 2: Read Dependencies
Parse manifest file to extract:
- Direct dependencies
- Dev dependencies
- Peer dependencies
- Version constraints

### Step 3: Check Updates
For npm projects:
```bash
npm outdated --json

Step 4: Security Scan

For npm projects:

npm audit --json

Step 5: License Analysis

Extract and categorize licenses:

Permissive: MIT, Apache, BSD
Copyleft: GPL, LGPL
Unknown: Needs manual review

Step 6: Generate Report

Compile findings:

Outdated packages with upgrade paths
Security vulnerabilities with severity
License compliance status

Tool Usage

Reading Manifests

Read package.json to extract dependencies:
- dependencies: production deps
- devDependencies: development deps
- peerDependencies: peer requirements

Running Commands

Execute npm audit:
- Capture JSON output
- Parse vulnerabilities
- Map to severity levels

Safety Considerations

Command Safety

Only run read-only commands
Never modify package files
No installation or updates without user consent

Output Safety

Exclude private package names if needed
Mask any credential patterns
Sanitize paths in output

Output

{
  "manifest": {
    "name": "my-project",
    "type": "npm",
    "dependencies": 45,
    "devDependencies": 20
  },
  "outdated": [
    {
      "name": "react",
      "current": "17.0.2",
      "latest": "18.2.0",
      "updateType": "major"
    }
  ],
  "vulnerabilities": [
    {
      "package": "lodash",
      "severity": "high",
      "title": "Prototype Pollution",
      "fixedIn": "4.17.21"
    }
  ],
  "licenses": {
    "mit": 40,
    "apache-2.0": 5,
    "unknown": 2
  },
  "recommendations": [
    "Update lodash to fix high-severity vulnerability",
    "Consider React 18 migration",
    "Review unknown licenses manually"
  ]
}


## Tool Integration Patterns

Different patterns for using tools effectively.

### Sequential Tool Use

Use tools one after another, each informed by the previous:

```markdown
## Sequential Pattern

### Flow
Tool A → Result A → Tool B (using A) → Result B → Output

### Example: Find and Analyze
1. Glob: Find all test files
2. Read: Read each test file
3. Analyze: Check test coverage patterns

### Benefits
- Simple to reason about
- Clear data flow
- Easy error handling

### Drawbacks
- Slower execution
- No parallelism

Parallel Tool Use

Use multiple tools simultaneously for efficiency:

## Parallel Pattern

### Flow
        ┌→ Tool A → Result A ─┐
Input ──┼→ Tool B → Result B ─┼→ Merge → Output
        └→ Tool C → Result C ─┘

### Example: Multi-Source Search
1. Parallel: Search in src/, lib/, tests/
2. Merge: Combine all results

### Benefits
- Faster execution
- Efficient resource use

### Drawbacks
- More complex error handling
- Merge logic needed

Conditional Tool Use

Choose tools based on context:

## Conditional Pattern

### Flow
Input → Analyze → If X: Tool A, If Y: Tool B → Output

### Example: Language-Specific Analysis
1. Detect: Identify project language
2. If Python: Run python-specific tools
3. If Node: Run node-specific tools

### Benefits
- Appropriate tool for context
- Avoids unnecessary work

### Drawbacks
- Need detection logic
- Multiple tool integrations

Iterative Tool Use

Use tools repeatedly until a condition is met:

## Iterative Pattern

### Flow
Input → Tool → Check → If incomplete: Tool again → Output

### Example: Paginated API
1. Fetch: Get first page
2. Check: More pages?
3. If yes: Fetch next page, append to results
4. Repeat until complete

### Benefits
- Handles unbounded data
- Adaptive to response size

### Drawbacks
- Need termination condition
- Potential for long runs

Error Handling for Tools

Tools can fail—handle gracefully.

Common Failure Modes

## Failure Types

### File System Failures
- File not found
- Permission denied
- Path too long
- Disk full

### API Failures
- Network timeout
- Rate limited
- Authentication failed
- Invalid response

### Command Failures
- Command not found
- Non-zero exit code
- Output parsing error
- Timeout exceeded

Error Handling Strategies

## Handling Strategies

### Retry with Backoff
```typescript
async function withRetry(operation, maxRetries = 3) {
  for (let i = 0; i < maxRetries; i++) {
    try {
      return await operation();
    } catch (error) {
      if (i === maxRetries - 1) throw error;
      await sleep(Math.pow(2, i) * 1000);
    }
  }
}

Graceful Degradation

If tool fails, continue with partial results:

Note what failed
Proceed with available data
Flag limitations in output

Fallback Operations

If primary tool fails, try alternative:

npm audit fails → use alternative scanner
API timeout → use cached data
File not found → use default

User Notification

When errors affect results:

Explain what happened
Describe impact on output
Suggest remediation


### Error Response Format

```markdown
## Error Output

```json
{
  "success": false,
  "partialResults": {
    "filesAnalyzed": 45,
    "issuesFound": 12
  },
  "errors": [
    {
      "tool": "npm-audit",
      "error": "Command failed with exit code 1",
      "impact": "Security scan incomplete",
      "workaround": "Run npm audit manually"
    }
  ],
  "recommendations": [
    "Resolve npm audit issues and retry",
    "Check network connectivity"
  ]
}


## Security Considerations

Tool access requires careful security.

### Permission Boundaries

```markdown
## Access Control

### File System
Allowed:
- Project directory and subdirectories
- Temp directories
- Explicitly allowed paths

Forbidden:
- Home directory hidden files
- System directories
- Other users' files
- Paths with ..

### Commands
Allowed:
- Read-only commands
- Whitelisted commands
- Sandboxed execution

Forbidden:
- Write/delete without confirmation
- Network-accessing commands
- System modification commands

### APIs
Allowed:
- Read operations
- Scoped to project resources
- Rate-limited calls

Forbidden:
- Write without confirmation
- Cross-project access
- Administrative operations

Input Validation

## Validation Rules

### Path Validation
- Normalize paths
- Check for traversal attempts
- Verify within allowed scope
- Resolve symlinks

### Command Validation
- Whitelist commands
- Escape arguments
- Limit argument length
- Block shell injection

### API Validation
- Validate URLs
- Check hostnames
- Verify credentials scope
- Sanitize parameters

Sensitive Data Handling

## Data Protection

### Detection
Identify sensitive patterns:
- API keys: /[a-zA-Z0-9]{32,}/
- Passwords: /password\s*=\s*['"][^'"]+['"]/
- Private keys: /-----BEGIN .* PRIVATE KEY-----/

### Handling
When detected:
- Mask in output
- Warn user
- Never log full values
- Suggest secure alternatives

### Storage
Never store:
- Credentials in plain text
- API keys in code
- Secrets in logs

Testing Level 3 Skills

Tool-enabled skills need rigorous testing.

Test Environment

## Test Setup

### Mock Tools
Create mock implementations:
- Return predefined responses
- Simulate failures
- Track calls for verification

### Test Files
Create test fixtures:
- Sample project structures
- Various file types
- Edge case content

### Isolated Execution
Run tests in isolation:
- Temporary directories
- Clean state each test
- No external dependencies

Test Categories

## Test Suite

### Happy Path
- Tool succeeds
- Expected output generated
- No errors

### Error Handling
- Tool fails gracefully
- Partial results returned
- Clear error messages

### Edge Cases
- Empty directories
- Very large files
- Deep nesting
- Special characters

### Security
- Path traversal blocked
- Sensitive data masked
- Commands validated

### Performance
- Reasonable execution time
- Memory usage bounded
- Handles large inputs

Conclusion

Level 3 tool-enabled skills transform AI from a text-only processor into a practical automation engine. By leveraging file access, APIs, and system interaction, these skills can analyze codebases, check dependencies, validate configurations, and much more.

Key principles for effective Level 3 skills:

Strategic tool use: Use the right tool for each task
Robust error handling: Gracefully handle tool failures
Security first: Validate all inputs, respect boundaries
Partial success: Return value even when some tools fail
Clear documentation: Explain what tools are used and why

Start with simple tool integrations—reading a configuration file, searching for patterns. As you gain experience, build more sophisticated skills that combine multiple tools for complex analysis and automation.

Level 3 skills are your gateway to practical AI automation—master them and you will be ready for the multi-agent coordination of Level 4.

Level 3 Skills: Tool-Enabled Capabilities

In this guide, we will explore how to design, build, and deploy Level 3 tool-enabled skills that safely and effectively bridge AI capabilities with system interactions.

Understanding Level 3 Skills

Level 3 skills occupy the middle of the complexity hierarchy:

Level	Complexity	Capabilities
1	Minimal	Prompt enhancement: tone, style, vocabulary
2	Low	Template-based generation with placeholders
3	Medium	Tool-enabled: file access, APIs, system interaction
4	High	Multi-agent coordination
5	Very High	Autonomous workflows

Core Characteristics

Level 3 skills have defining traits:

Tool Access: Can use tools to interact with systems beyond pure text.

Real Effects: Actions can create, modify, or delete actual resources.

External Data: Can incorporate information from files, APIs, and databases.

Validation Capability: Can verify output by checking against real systems.

Error Handling: Must handle tool failures gracefully.

What Level 3 Skills Do

Tool-enabled capabilities include:

File Operations: Read, write, search, modify files
API Integration: Call external services for data or actions
Database Access: Query and update data stores
System Commands: Execute shell commands safely
Web Interaction: Fetch and parse web content
Search: Find information across sources

What Level 3 Skills Cannot Do

These skills still have limitations:

Cannot coordinate multiple specialized agents
Cannot make complex autonomous decisions
Cannot manage long-running workflows
Cannot adapt strategy based on results

For these capabilities, you need Level 4 and above.

Available Tools

Level 3 skills leverage various tool types.

File System Tools

## File System Capabilities

### Read Operations
- Read file contents
- List directory contents
- Search files by pattern
- Get file metadata

### Write Operations
- Create new files
- Modify existing files
- Move/rename files
- Delete files (with caution)

### Search Operations
- Glob patterns for file matching
- Grep for content searching
- Recursive directory traversal

### Safety Considerations
- Respect permission boundaries
- Never access sensitive paths
- Validate paths before operations
- Backup before destructive operations

API Tools

## API Capabilities

### HTTP Methods
- GET: Retrieve data
- POST: Submit data
- PUT: Update resources
- DELETE: Remove resources

### Common APIs
- GitHub: Repository operations
- Database: Data queries
- External services: Various integrations

### Safety Considerations
- Use least-privilege credentials
- Validate responses
- Handle rate limits
- Secure sensitive data

System Tools

## System Capabilities

### Command Execution
- Run shell commands
- Capture output
- Handle errors

### Environment
- Read environment variables
- Access configuration

### Safety Considerations
- Whitelist allowed commands
- Sandbox execution
- Validate all inputs
- Limit resource usage

Building Level 3 Skills

Let us create tool-enabled skills step by step.

Example: Codebase Analyzer

---
name: codebase-analyzer
description: Analyzes codebase using file system tools
version: 1.0.0
tools:
  - Glob
  - Grep
  - Read
---

# Codebase Analyzer

Analyze codebases using file system access for comprehensive insights.

## Capabilities

This skill can:
- Search for files by pattern
- Read file contents
- Search for patterns in code
- Aggregate findings

## Workflow

### Step 1: Discovery
Use Glob to find relevant files:
- Source files: `**/*.{js,ts,py,go,rs}`
- Configuration: `**/package.json`, `**/*.config.*`
- Documentation: `**/*.md`, `**/docs/**`

### Step 2: Structure Analysis
For each discovered file type:
- Count files by extension
- Calculate total lines
- Identify primary language

### Step 3: Pattern Search
Use Grep to find:
- TODO comments
- FIXME notes
- Deprecated usage
- Security patterns (passwords, keys)

### Step 4: Content Analysis
Read key files:
- Entry points (index, main, app)
- Configuration files
- README and docs

### Step 5: Synthesis
Combine findings into report:
- Codebase overview
- Language breakdown
- Issues found
- Recommendations

## Tool Usage

### Using Glob
```markdown
Find all TypeScript files:
Pattern: **/*.ts
Path: /project/root

Using Grep

Find TODO comments:
Pattern: TODO|FIXME|HACK
Type: ts
Path: /project/root

Using Read

Read package.json:
File: /project/root/package.json

Output

{
  "overview": {
    "totalFiles": 150,
    "totalLines": 25000,
    "primaryLanguage": "TypeScript"
  },
  "languages": {
    "typescript": { "files": 120, "lines": 20000 },
    "javascript": { "files": 20, "lines": 3000 },
    "json": { "files": 10, "lines": 2000 }
  },
  "issues": {
    "todos": 45,
    "fixmes": 12,
    "deprecated": 3
  },
  "insights": [
    "Large codebase with good TypeScript coverage",
    "45 TODO items suggest pending work",
    "No obvious security issues detected"
  ],
  "recommendations": [
    "Address FIXME items in priority order",
    "Consider TypeScript strict mode",
    "Add missing documentation"
  ]
}


### Example: Dependency Checker

```markdown
---
name: dependency-checker
description: Checks project dependencies for issues
version: 1.0.0
tools:
  - Read
  - Bash
---

# Dependency Checker

Analyze project dependencies for outdated packages, vulnerabilities, and license issues.

## Capabilities

- Read package manifests
- Check for updates
- Scan for vulnerabilities
- Analyze licenses

## Workflow

### Step 1: Detect Package Manager
Read project files to determine package manager:
- package.json → npm/yarn/pnpm
- requirements.txt → pip
- go.mod → go modules
- Cargo.toml → cargo

### Step 2: Read Dependencies
Parse manifest file to extract:
- Direct dependencies
- Dev dependencies
- Peer dependencies
- Version constraints

### Step 3: Check Updates
For npm projects:
```bash
npm outdated --json

Step 4: Security Scan

For npm projects:

npm audit --json

Step 5: License Analysis

Extract and categorize licenses:

Permissive: MIT, Apache, BSD
Copyleft: GPL, LGPL
Unknown: Needs manual review

Step 6: Generate Report

Compile findings:

Outdated packages with upgrade paths
Security vulnerabilities with severity
License compliance status

Tool Usage

Reading Manifests

Read package.json to extract dependencies:
- dependencies: production deps
- devDependencies: development deps
- peerDependencies: peer requirements

Running Commands

Execute npm audit:
- Capture JSON output
- Parse vulnerabilities
- Map to severity levels

Safety Considerations

Command Safety

Only run read-only commands
Never modify package files
No installation or updates without user consent

Output Safety

Exclude private package names if needed
Mask any credential patterns
Sanitize paths in output

Output

{
  "manifest": {
    "name": "my-project",
    "type": "npm",
    "dependencies": 45,
    "devDependencies": 20
  },
  "outdated": [
    {
      "name": "react",
      "current": "17.0.2",
      "latest": "18.2.0",
      "updateType": "major"
    }
  ],
  "vulnerabilities": [
    {
      "package": "lodash",
      "severity": "high",
      "title": "Prototype Pollution",
      "fixedIn": "4.17.21"
    }
  ],
  "licenses": {
    "mit": 40,
    "apache-2.0": 5,
    "unknown": 2
  },
  "recommendations": [
    "Update lodash to fix high-severity vulnerability",
    "Consider React 18 migration",
    "Review unknown licenses manually"
  ]
}


## Tool Integration Patterns

Different patterns for using tools effectively.

### Sequential Tool Use

Use tools one after another, each informed by the previous:

```markdown
## Sequential Pattern

### Flow
Tool A → Result A → Tool B (using A) → Result B → Output

### Example: Find and Analyze
1. Glob: Find all test files
2. Read: Read each test file
3. Analyze: Check test coverage patterns

### Benefits
- Simple to reason about
- Clear data flow
- Easy error handling

### Drawbacks
- Slower execution
- No parallelism

Parallel Tool Use

Use multiple tools simultaneously for efficiency:

## Parallel Pattern

### Flow
        ┌→ Tool A → Result A ─┐
Input ──┼→ Tool B → Result B ─┼→ Merge → Output
        └→ Tool C → Result C ─┘

### Example: Multi-Source Search
1. Parallel: Search in src/, lib/, tests/
2. Merge: Combine all results

### Benefits
- Faster execution
- Efficient resource use

### Drawbacks
- More complex error handling
- Merge logic needed

Conditional Tool Use

Choose tools based on context:

## Conditional Pattern

### Flow
Input → Analyze → If X: Tool A, If Y: Tool B → Output

### Example: Language-Specific Analysis
1. Detect: Identify project language
2. If Python: Run python-specific tools
3. If Node: Run node-specific tools

### Benefits
- Appropriate tool for context
- Avoids unnecessary work

### Drawbacks
- Need detection logic
- Multiple tool integrations

Iterative Tool Use

Use tools repeatedly until a condition is met:

## Iterative Pattern

### Flow
Input → Tool → Check → If incomplete: Tool again → Output

### Example: Paginated API
1. Fetch: Get first page
2. Check: More pages?
3. If yes: Fetch next page, append to results
4. Repeat until complete

### Benefits
- Handles unbounded data
- Adaptive to response size

### Drawbacks
- Need termination condition
- Potential for long runs

Error Handling for Tools

Tools can fail—handle gracefully.

Common Failure Modes

## Failure Types

### File System Failures
- File not found
- Permission denied
- Path too long
- Disk full

### API Failures
- Network timeout
- Rate limited
- Authentication failed
- Invalid response

### Command Failures
- Command not found
- Non-zero exit code
- Output parsing error
- Timeout exceeded

Error Handling Strategies

## Handling Strategies

### Retry with Backoff
```typescript
async function withRetry(operation, maxRetries = 3) {
  for (let i = 0; i < maxRetries; i++) {
    try {
      return await operation();
    } catch (error) {
      if (i === maxRetries - 1) throw error;
      await sleep(Math.pow(2, i) * 1000);
    }
  }
}

Graceful Degradation

If tool fails, continue with partial results:

Note what failed
Proceed with available data
Flag limitations in output

Fallback Operations

If primary tool fails, try alternative:

npm audit fails → use alternative scanner
API timeout → use cached data
File not found → use default

User Notification

When errors affect results:

Explain what happened
Describe impact on output
Suggest remediation


### Error Response Format

```markdown
## Error Output

```json
{
  "success": false,
  "partialResults": {
    "filesAnalyzed": 45,
    "issuesFound": 12
  },
  "errors": [
    {
      "tool": "npm-audit",
      "error": "Command failed with exit code 1",
      "impact": "Security scan incomplete",
      "workaround": "Run npm audit manually"
    }
  ],
  "recommendations": [
    "Resolve npm audit issues and retry",
    "Check network connectivity"
  ]
}


## Security Considerations

Tool access requires careful security.

### Permission Boundaries

```markdown
## Access Control

### File System
Allowed:
- Project directory and subdirectories
- Temp directories
- Explicitly allowed paths

Forbidden:
- Home directory hidden files
- System directories
- Other users' files
- Paths with ..

### Commands
Allowed:
- Read-only commands
- Whitelisted commands
- Sandboxed execution

Forbidden:
- Write/delete without confirmation
- Network-accessing commands
- System modification commands

### APIs
Allowed:
- Read operations
- Scoped to project resources
- Rate-limited calls

Forbidden:
- Write without confirmation
- Cross-project access
- Administrative operations

Input Validation

## Validation Rules

### Path Validation
- Normalize paths
- Check for traversal attempts
- Verify within allowed scope
- Resolve symlinks

### Command Validation
- Whitelist commands
- Escape arguments
- Limit argument length
- Block shell injection

### API Validation
- Validate URLs
- Check hostnames
- Verify credentials scope
- Sanitize parameters

Sensitive Data Handling

## Data Protection

### Detection
Identify sensitive patterns:
- API keys: /[a-zA-Z0-9]{32,}/
- Passwords: /password\s*=\s*['"][^'"]+['"]/
- Private keys: /-----BEGIN .* PRIVATE KEY-----/

### Handling
When detected:
- Mask in output
- Warn user
- Never log full values
- Suggest secure alternatives

### Storage
Never store:
- Credentials in plain text
- API keys in code
- Secrets in logs

Testing Level 3 Skills

Tool-enabled skills need rigorous testing.

Test Environment

## Test Setup

### Mock Tools
Create mock implementations:
- Return predefined responses
- Simulate failures
- Track calls for verification

### Test Files
Create test fixtures:
- Sample project structures
- Various file types
- Edge case content

### Isolated Execution
Run tests in isolation:
- Temporary directories
- Clean state each test
- No external dependencies

Test Categories

## Test Suite

### Happy Path
- Tool succeeds
- Expected output generated
- No errors

### Error Handling
- Tool fails gracefully
- Partial results returned
- Clear error messages

### Edge Cases
- Empty directories
- Very large files
- Deep nesting
- Special characters

### Security
- Path traversal blocked
- Sensitive data masked
- Commands validated

### Performance
- Reasonable execution time
- Memory usage bounded
- Handles large inputs

Conclusion

Key principles for effective Level 3 skills:

Strategic tool use: Use the right tool for each task
Robust error handling: Gracefully handle tool failures
Security first: Validate all inputs, respect boundaries
Partial success: Return value even when some tools fail
Clear documentation: Explain what tools are used and why

Level 3 skills are your gateway to practical AI automation—master them and you will be ready for the multi-agent coordination of Level 4.