security-scan

Scan your Claude Code configuration (.claude/ directory) for security vulnerabilities, misconfigurations, and injection risks using AgentShield. Checks CLAUDE.md, settings.json, MCP servers, hooks, and agent definitions.

Quality

66%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/security-scan/SKILL.md

Quality

Content

65%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with concrete commands and a clear structure, but it leans monolithic and repeats the base command unnecessarily. The mutating --fix workflow also lacks an explicit validation checkpoint.

Suggestions

Factor the repeated 'npx ecc-agentshield scan' into a single base command and show only the differing flags per output format.

Add an explicit validate/review checkpoint before applying --fix results (e.g., review the diff, then re-run a read-only scan to confirm the grade improved).

Move the Severity Levels and Interpreting Results tables into a separate reference file and link to it from the main body to improve progressive disclosure.

Dimension	Reasoning	Score
Conciseness	The body is mostly efficient with tables and commands, but the base 'npx ecc-agentshield scan' command is repeated redundantly across each output-format and severity example, so it could be tightened. Not score 3 because of that repetition; not score 1 because there is no padded concept explanation Claude already knows.	2 / 3
Actionability	Provides fully executable, copy-paste-ready commands (npx scan variants, --fix, init), a concrete GitHub Action YAML block, and a severity-grade table — matching the fully-executable anchor.	3 / 3
Workflow Clarity	Triggers, scan scope, and severity-based remediation are sequenced, but the auto-fix path modifies files without an explicit validate/review checkpoint, so checkpoints are missing rather than present. Not score 3 because the mutating --fix flow lacks a feedback loop.	2 / 3
Progressive Disclosure	Sections are well organized, but the ~160-line body is monolithic with no bundle files and everything inline; content such as the full severity/interpreting-results reference could be split out. Not score 3 because the file is well over 50 lines with no one-level-deep references.	2 / 3
	Total	9 / 12 Passed

Description

67%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and clearly differentiated, naming concrete scan targets and a distinct niche. Its main weakness is the absence of an explicit 'Use when...' trigger clause, which leaves the activation context implied rather than stated.

Suggestions

Add an explicit 'Use when...' trigger clause, e.g. 'Use when setting up or modifying Claude Code configs and you want a security audit.'

Include more natural user phrasings such as 'audit', 'harden', or 'check my Claude Code config for secrets'.

Reconsider first-line phrasing so the opening verb directly states the action without leaning on the tool name.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete targets and actions — 'security vulnerabilities, misconfigurations, and injection risks' plus 'Checks CLAUDE.md, settings.json, MCP servers, hooks, and agent definitions' — matching the multi-action anchor.	3 / 3
Completeness	Clearly states what the skill does, but the 'when' is only implied; a missing explicit 'Use when...' clause caps completeness at 2 per the rubric guidelines.	2 / 3
Trigger Term Quality	Terms like 'security vulnerabilities' and 'injection risks' are reasonably natural, but coverage lacks common user variations and there is no explicit 'Use when...' trigger phrasing. Not score 3 because common phrasings a user would say are incomplete.	2 / 3
Distinctiveness Conflict Risk	Targets a clear niche (Claude Code .claude/ security auditing via AgentShield) with distinct triggers unlikely to conflict with other skills.	3 / 3
	Total	10 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: affaan-m/ECC
Commit: 754b8dd

Reviewed: 4 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.