CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

security-scan

Scan your Claude Code configuration (.claude/ directory) for security vulnerabilities, misconfigurations, and injection risks using AgentShield. Checks CLAUDE.md, settings.json, MCP servers, hooks, and agent definitions. Use when auditing a .claude/ directory — CLAUDE.md, settings.json, MCP servers, hooks, or agent definitions.

63

Quality

79%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/security-scan/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

68%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable command catalog with excellent executable examples, but it reads more as tool documentation than a workflow: it lacks an explicit scan → review → fix → re-scan sequence with verification, and it spends meaningful tokens restating output the tool itself produces.

Suggestions

Add a short numbered workflow with a validation checkpoint, e.g. 1) scan, 2) review critical/high findings, 3) apply --fix, 4) re-scan to confirm the grade improved.

Move the 'Severity Levels' and 'Interpreting Results' detail into a reference file (e.g. references/findings.md) and keep a two-line severity summary in SKILL.md, since the scanner prints this information itself.

Trim restated tool output (severity table, finding lists) in favor of guidance Claude can't get from the tool, such as remediation steps for the most common critical findings.

DimensionReasoningScore

Conciseness

Command examples and tables are dense and useful, but the 'Severity Levels' and 'Interpreting Results' sections (~35 of ~160 lines) restate documentation the scanner itself emits at runtime, which is explanation Claude does not need in context.

3 / 5

Actionability

Fully executable, copy-paste-ready commands throughout — scan variants, output formats (--format json/markdown/html), --fix, --opus pipeline, init scaffolding, and a complete GitHub Action YAML snippet — covering the common cases.

5 / 5

Workflow Clarity

Section order implies a flow (prerequisites → scan → fix) but no explicit sequence or validation checkpoints are given; in particular, --fix mutates configuration files with no re-scan/verify feedback loop, which caps this dimension at 3 per the destructive-operation guideline.

3 / 5

Progressive Disclosure

Well-organized single-file skill with clear section headers, tables, and one-level external links (GitHub, npm); however, the findings taxonomy and severity interpretation (~35 lines) is inlined and could be split into a reference file to keep SKILL.md a leaner overview.

4 / 5

Total

15

/

20

Passed

Description

82%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description with explicit what/when structure, concrete file-level triggers, and a distinct niche. The main weaknesses are the second-person 'your' phrasing and reliance on a single scan/check action verb rather than varied concrete actions.

Suggestions

Rewrite in third person / bare imperative without possessives: 'Scans the Claude Code configuration (.claude/ directory)...' instead of 'Scan your Claude Code configuration'.

Vary the action verbs to name distinct capabilities, e.g. 'Scans, grades, and auto-fixes security issues in .claude/ configuration'.

Add one or two natural user phrasings to the when-clause, e.g. 'Use when the user asks to audit, harden, or security-review their Claude Code setup'.

DimensionReasoningScore

Specificity

The description names the domain and enumerates concrete targets ('Checks CLAUDE.md, settings.json, MCP servers, hooks, and agent definitions' for 'security vulnerabilities, misconfigurations, and injection risks'), but relies on a single action verb and uses second-person voice ('Scan your Claude Code configuration'), which the guidelines penalize by one point from an otherwise 4-level listing of specific checks.

3 / 5

Completeness

It explicitly answers both what ('Scan your Claude Code configuration (.claude/ directory) for security vulnerabilities... using AgentShield') and when ('Use when auditing a .claude/ directory — CLAUDE.md, settings.json, MCP servers, hooks, or agent definitions') with concrete trigger phrases.

5 / 5

Trigger Term Quality

Good natural keyword coverage including 'security vulnerabilities', 'misconfigurations', 'injection risks', 'auditing', and concrete file names (CLAUDE.md, settings.json, MCP servers, hooks), though a few natural synonyms users might say ('harden', 'security review', 'pentest config') are missing.

4 / 5

Distinctiveness Conflict Risk

The niche is clear and distinct — auditing Claude Code's own .claude/ configuration via AgentShield — with file-level triggers that are unlikely to collide with other skills.

5 / 5

Total

17

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

Total

15

/

16

Passed

Repository

affaan-m/ECC

Path

skills/security-scan/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.