security-scan

Scan your Claude Code configuration (.claude/ directory) for security vulnerabilities, misconfigurations, and injection risks using AgentShield. Checks CLAUDE.md, settings.json, MCP servers, hooks, and agent definitions. Use when auditing a .claude/ directory — CLAUDE.md, settings.json, MCP servers, hooks, or agent definitions.

Quality

85%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

The canonical home for this skill is jbvc/claude-security-scan

Quality

Content

76%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

Highly actionable command catalog with strong section structure, but the auto-fix workflow lacks an explicit validation/re-verify checkpoint and some reference-style tables are inlined rather than split out.

Suggestions

Add an explicit validation step after `--fix` (e.g., re-run `npx ecc-agentshield scan` and confirm the grade improved / no new findings before declaring success) to lift workflow clarity above 3.

Remove the 'When to Activate' bullets or fold them into the description to avoid duplicating trigger information that is already in the frontmatter.

Consider moving the 'Severity Levels' and 'Interpreting Results' tables into a references/ file (e.g. FINDINGS.md) linked from the body to improve progressive disclosure for this longer-than-50-line skill.

Dimension	Reasoning	Score
Conciseness	Mostly lean command reference and tables with executable snippets throughout; the 'When to Activate' list duplicates trigger info already in the description and the 'Interpreting Results' section is reference material that pads length, but no severe concept over-explanation.	4 / 5
Actionability	Fully executable, copy-paste-ready npx/npm commands covering basic scan, path and severity flags, output formats, auto-fix, the Opus pipeline, init scaffolding, and a GitHub Action example — concrete guidance across common cases.	5 / 5
Workflow Clarity	The scan-interpret-fix sequence is present and prioritized by severity, but there are no explicit validation checkpoints; because the auto-fix path modifies configuration (a destructive/batch-style operation) without a verify-then-proceed loop, workflow clarity is capped at 3 per the rubric guidance.	3 / 5
Progressive Disclosure	Well-organized with clear section headers and a self-contained single-file structure (no nested or broken bundle references); minor gap is that the Severity Levels and Interpreting Results tables are reference-style content inlined in SKILL.md rather than split into a separate file.	4 / 5
	Total	16 / 20 Passed

Description

95%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that clearly states both capability and trigger conditions with concrete file-name keywords. The only flaw is second-person voice ('Scan your...'), which costs one specificity point.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions (scan for vulnerabilities, misconfigurations, injection risks) and enumerates five config components checked (CLAUDE.md, settings.json, MCP servers, hooks, agent definitions), which is comprehensive coverage; reduced from 5 to 4 because 'Scan your Claude Code configuration' uses second-person voice rather than the required third person.	4 / 5
Completeness	Explicitly answers both what ('Scan your Claude Code configuration for security vulnerabilities, misconfigurations, and injection risks') and when ('Use when auditing a .claude/ directory — ...') with concrete trigger phrases.	5 / 5
Trigger Term Quality	Comprehensive natural terms users would actually say — 'audit', 'security vulnerabilities', 'Claude Code configuration', '.claude/ directory', and concrete file names CLAUDE.md, settings.json, MCP servers, hooks, agent definitions — covering synonyms and specific filenames.	5 / 5
Distinctiveness Conflict Risk	Clear niche (security auditing of Claude Code's .claude/ directory) with distinct, specific triggers tied to named config artifacts, giving minimal overlap risk with other skills.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: affaan-m/everything-claude-code
Path: skills/security-scan/SKILL.md
Commit: 06c5e11

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.