By default, a skill can use any tool Claude has access to. The allowed-tools field changes that.
allowed-tools: Read, Grep, Glob
With this in your frontmatter, Claude can only read files during this skill. It can't write, run bash commands, or call external APIs.
This matters when you want a skill to only analyze code, never modify it. It also makes the skill faster because Claude doesn't have to decide whether a tool is appropriate when the constraint is already in the frontmatter. I'd write skills with the minimum tools they need.