CtrlK
BlogDocsLog inGet started
Tessl Logo

security-scan

AgentShield を使用して、Claude Code の設定(.claude/ ディレクトリ)のセキュリティ脆弱性、設定ミス、インジェクションリスクをスキャンします。CLAUDE.md、settings.json、MCP サーバー、フック、エージェント定義をチェックします。

81

2.25x
Quality

73%

Does it follow best practices?

Impact

97%

2.25x

Average score across 3 eval scenarios

SecuritybySnyk

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./docs/ja-JP/skills/security-scan/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

76%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-structured command reference with executable examples throughout; its main gap is the missing validation feedback loop for the destructive `--fix` operation, which caps workflow clarity.

Suggestions

Add an explicit verify step after `--fix`, e.g. re-run `npx ecc-agentshield scan` and review the diff before committing, to establish a scan → fix → re-scan feedback loop.

Move the '結果の解釈' severity/findings tables into a references file and link to it from SKILL.md to tighten the overview and lift progressive disclosure.

Clarify that `--fix` only applies autofixable changes and that manual findings require review, so the destructive-flow boundary is explicit.

DimensionReasoningScore

Conciseness

The body is lean — tables, fenced command blocks, and short lists — and avoids re-explaining concepts Claude already knows; only the '結果の解釈' reference tables add mild explanatory bulk that could be trimmed.

4 / 5

Actionability

Commands are concrete and copy-paste ready across all common cases (basic scan, --path/--min-severity/--format flags, --fix, --opus --stream with API key export, init, and a GitHub Action YAML), fully executable with no placeholders.

5 / 5

Workflow Clarity

The Opus pipeline is sequenced (1-2-3) but the `--fix` flow auto-applies changes to config files with no validation/re-scan checkpoint, and the destructive/auto-fix cap prevents scoring above 3 despite the otherwise clear command reference.

3 / 5

Progressive Disclosure

Content is organized into clearly headed sections (起動タイミング, スキャン対象, 使用方法, etc.) with appropriate inline command reference and one-level external links to GitHub/npm; no bundle files exist, and most content is correctly inline, with only minor organization gaps.

4 / 5

Total

16

/

20

Passed

Description

70%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, well-scoped description with third-person voice and concrete scan targets, but it omits any explicit 'use when' trigger guidance, which caps completeness. Adding a trigger clause would raise the weakest dimension.

Suggestions

Append an explicit trigger clause, e.g. 'Use when setting up a new Claude Code project, after changing .claude/settings.json or CLAUDE.md, or for periodic security hygiene checks.'

Add a couple of natural synonyms (監査/audit, 権限/permissions) to broaden trigger-term coverage.

DimensionReasoningScore

Specificity

Names the tool (AgentShield), domain, three risk categories (脆弱性/設定ミス/インジェクションリスク), and five concrete scan targets, giving broad coverage, but uses essentially one verb (スキャン/チェック) rather than multiple distinct actions, so it sits just below the comprehensive-action anchor.

4 / 5

Completeness

The description clearly states what it does (scan Claude Code settings for security issues across named files) but provides no 'when to use' / trigger guidance at all, so per the rubric cap a clear 'what' with missing 'when' cannot exceed 3.

3 / 5

Trigger Term Quality

Natural phrases like セキュリティ脆弱性, 設定ミス, インジェクションリスク, and Claude Code の設定 cover the common ways a user would ask for this, but a few natural synonyms (e.g., 監査/audit, 強化/hardening, 権限/permissions) are absent.

4 / 5

Distinctiveness Conflict Risk

It carves a precise niche — AgentShield-based security auditing of Claude Code's .claude/ configuration — that is unlikely to overlap with or mis-trigger other skills.

5 / 5

Total

16

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
affaan-m/ECC
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.