security-scan

使用AgentShield扫描您的Claude代码配置（.claude/目录），以发现安全漏洞、配置错误和注入风险。检查CLAUDE.md、settings.json、MCP服务器、钩子和代理定义。

1.72x

Quality

66%

Does it follow best practices?

Impact

100%

1.72x

Average score across 3 eval scenarios

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./docs/zh-CN/skills/security-scan/SKILL.md

Quality

Content

76%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, highly actionable security-scan skill with concrete commands throughout and no over-explanation. Its main weakness is the missing validation/verification loop around the autofix operation, which caps workflow clarity.

Suggestions

Add an explicit validate->fix->verify loop for the `--fix` flow: scan, review findings, apply --fix only to safe items, then re-run `npx ecc-agentshield scan` to confirm the config still parses and severity improved.

Factor the repeated `npx ecc-agentshield scan` invocation out of the output-format examples to tighten conciseness.

Optionally move the GitHub Action snippet and severity-grade table into a referenced file to give the body a clearer overview-first structure.

Dimension	Reasoning	Score
Conciseness	The body is efficient and assumes Claude's competence — it does not explain what .claude or MCP is — with only minor trimmable padding (the full `npx ecc-agentshield scan` command repeated in each code block and the explanatory '这将' bullet lists), placing it just above the efficient anchor rather than at fully lean.	4 / 5
Actionability	Fully executable, copy-paste-ready commands with concrete flags cover the common cases (basic scan, --path, --min-severity, --format json/markdown/html, --fix, --opus --stream, init, GitHub Action), matching the fully-executable anchor.	5 / 5
Workflow Clarity	Content is organized into clear sections, but the autofix path (`--fix`) rewrites config (replacing hardcoded keys, tightening permissions) with no validate-then-fix-then-verify checkpoint; the guideline caps workflow clarity at 3 for batch/destructive operations lacking validation steps.	3 / 5
Progressive Disclosure	Well-structured with clear section headers and no bundle files or nested references needed; the single self-contained file is appropriately organized, with only minor gaps (e.g., the GitHub Action and severity-grade content could optionally live in referenced material) keeping it just below the clear-overview anchor.	4 / 5
	Total	16 / 20 Passed

Description

57%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description conveys a clear, specific niche and concrete targets, but it is written in second person and omits an explicit 'Use when' trigger clause, which caps completeness and lowers specificity. Adding a third-person trigger clause and switching to third-person voice would lift specificity and completeness.

Suggestions

Add an explicit 'Use when...' clause naming concrete trigger situations (e.g., setting up a new Claude Code project, after editing settings.json/CLAUDE.md/MCP config, before committing config changes).

Rewrite in third person ('Scans Claude Code configurations...' instead of '扫描您的...') to recover the specificity penalty.

Include natural synonyms and file extensions users might mention (e.g., 'security audit', 'CLAUDE.md review', '.claude directory', 'permission hardening') to broaden trigger-term coverage.

Dimension	Reasoning	Score
Specificity	Lists several concrete actions ('扫描', '发现安全漏洞、配置错误和注入风险', '检查CLAUDE.md、settings.json、MCP服务器、钩子和代理定义') and enumerates specific targets, but uses second person ('您的') which the guidelines penalize by reducing specificity by 1, pulling a 4 down to 3.	3 / 5
Completeness	The 'what' is clearly stated (scan Claude config to find security issues) but there is no explicit 'when'/'Use when' trigger clause, and the guideline caps completeness at 3 when trigger guidance is missing.	3 / 5
Trigger Term Quality	Relevant natural terms are present ('安全漏洞', '配置错误', '注入风险', '.claude/', 'MCP服务器', '钩子') that a user might say, but coverage lacks synonyms, file extensions, and any 'use when' phrasing, so it sits at the some-keywords-but-missing-variations anchor rather than good coverage.	3 / 5
Distinctiveness Conflict Risk	A narrow, well-defined niche (AgentShield scanning of the .claude/ directory with named artifact types) gives it distinct triggers and minimal overlap with other skills.	5 / 5
	Total	14 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: affaan-m/ECC
Path: docs/zh-CN/skills/security-scan/SKILL.md
Commit: e04ea0b

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.