Built-in skills: 3 content defects (security-review, keybindings-help, update-config)

Summary

Audited the built-in skills bundled with the Claude Code CLI (v2.1.229) by invoking each via the Skill tool and inspecting the loaded content. Found 3 confirmed defects that are genuinely compiled into the CLI binary (not editable client-side, so filing here).

Edit: the original version of this issue included 2 more items (stale superpowers: cross-references in executing-plans/writing-plans/subagent-driven-development/writing-skills, and an orphaned reference file in using-superpowers). Those turned out to be bugs in a locally vendored copy of the community "superpowers" skill pack living in my own project repo, not in the Claude Code CLI itself — retracted from this report, see comment below. Sorry for the noise.

1. security-review doesn't handle the no-diff case

With a clean working tree (no diff), the diff-gathering step leaves the literal placeholder text (Bash completed with no output) in the FILES MODIFIED / COMMITS / DIFF CONTENT sections, and the skill still instructs "Review the complete diff above. This contains all code changes in the PR." over that empty placeholder, instead of detecting and reporting the no-diff case.

2. keybindings-help reference table has data-generation defects

The "Available Actions" table:

• duplicates default keys for some actions, e.g. select:next → "down, j, ctrl+n, down, j, ctrl+n"; scroll:top → "g, home, ctrl+home, g, home"
• lists Context as "Unknown" for several actions (strip:jump1…strip:new, selection:clear), but "Unknown" isn't in the same skill's own "Available Contexts" table, so its "validate against the known lists" instruction can't be satisfied for those rows
• some actions are filed under the wrong context (e.g. confirm:no, select:accept listed under "Settings" instead of "Confirmation"/"Select" like their siblings)

3. update-config embeds an ambiguous/duplicated schema key

The embedded settings-schema snippet defines disableAutoMode twice with identical shape ("type":"string","enum":["disable"]) — once nested under permissions.disableAutoMode, once as a top-level root property — with nothing indicating which is authoritative.

Environment

Claude Code CLI 2.1.229, Windows 11. Found via a full audit of all installed/built-in skills.