Claude Code writes two records to your disk: an append-only ledger of every exchange with the model, and a small cached snapshot of how full your rate limits are. Almost every tool and blog post about local usage tracking knows about the first one and misses the second — including, until I actually looked, me.
Every "always allow" click quietly trades a little control for a little convenience — and after a few months of daily agent use, those clicks add up to a security posture nobody designed. Here's how to audit what your coding agent can already do without asking, which grants deserve scrutiny, and how to put deliberate guardrails back.
Claude Code skills have no requires: field, no imports, no dependency resolver — and yet you can build a real graph of skills that depend on each other. This post lays out the mental model, the three composition mechanisms that fall out of it, and a refactor of this blog's own skill folder as a case study in what happens when you skip them.
Your ~/.claude folder quietly accumulates two very different things: configuration you'd hate to lose, and private data you must never publish. Here's how to put the first under git without ever committing the second.
Every post on this blog needs two images that do completely different jobs: a social card that has to earn a click in a feed, and an inline hero that opens the article. This post is about how the blog makes both — a typographic default that costs nothing, an opt-in artificial-intelligence (AI) cover that costs about four cents, and the little Model Context Protocol (MCP) server that wires an image model straight into Claude Code. The cover above was made by that exact pipeline.
Claude Code can be customized along a spectrum: at one end, plain-language instructions you hope the model follows; at the other, hooks and settings the harness enforces whether the model cooperates or not. This post maps that full surface and shows how to actually wire it up on a real project.
Most people install Claude Code, talk to it like a chatbot, and stop there. The difference between that and a genuine force multiplier is a small amount of configuration: a file that tells it your conventions, a couple of hooks that enforce quality automatically, and one skill that encodes a workflow you'd otherwise re-type every day.