Tessl • The management layer for AI agent skills

SkillPublic

security-scan

Scan your Claude Code configuration (.claude/ directory) for security vulnerabilities, misconfigurations, and injection risks using AgentShield. Checks CLAUDE.md, settings.json, MCP servers, hooks, and agent definitions.

Quality

76%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/security-scan/SKILL.md

The canonical home for this skill is security-scan in affaan-m/ECC

Quality

Content

76%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

This is a highly actionable, tool-specific reference: every workflow comes with executable commands, output-format options, and a CI integration example, and the writing stays lean without padding. The main gaps are workflow-oriented — the overall process is implicit rather than sequenced, and the auto-fix batch operation lacks a verification/re-scan feedback loop. Organization within the single file is good, with only minor redundancy between the findings and severity sections.

Suggestions

Add a verification step after `--fix`: re-run `npx ecc-agentshield scan` to confirm the grade improved and review any remaining manual-only findings.

Present an explicit ordered workflow (1. verify AgentShield is installed, 2. run scan, 3. triage findings by severity, 4. apply auto-fix, 5. re-scan to verify) instead of leaving the sequence implicit across sections.

Consolidate the overlapping "What It Scans" checks, "Severity Levels" table, and "Interpreting Results" categories into one triage section to trim redundancy.

Dimension	Reasoning	Score
Conciseness	The body is efficient: tables ("What It Scans", "Severity Levels") and terse command blocks with no explanation of concepts Claude already knows. Not 5 because of minor redundancy — three install variants despite every usage example using npx, and "Interpreting Results" partially restating the severity table and scan-checks table.	4 / 5
Actionability	Every section provides copy-paste-ready commands: `npx ecc-agentshield scan --path`, `--min-severity`, `--format json\|markdown\|html`, `--fix`, `--opus --stream`, `init`, and a complete GitHub Action YAML block. The examples cover the common cases (basic scan, CI integration, output formats, auto-fix).	5 / 5
Workflow Clarity	The sequence (prerequisites → scan → interpret by severity → fix) is present but implicit across sections rather than explicitly ordered, and the auto-fix path is a batch modification of config files with no re-scan/verification step. Per the rubric guideline, a batch operation without validation caps workflow clarity at 3 even for an otherwise single-purpose skill.	3 / 5
Progressive Disclosure	The skill has no bundle files, and the single file is well-organized with clear sections, tables, and code blocks; the CLI usage content is appropriately inline. Not 5 because at ~160 lines the "Interpreting Results" severity detail is inline content that could be split into a reference file, per the anchor for good-but-not-perfect placement.	4 / 5
	Total	16 / 20 Passed

Description

66%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description gives a concrete, well-scoped picture of what the skill does, enumerating specific config files and check categories with good natural keywords. Its main weakness is the complete absence of any "Use when..." trigger guidance, which both caps completeness and leaves the activation conditions implicit. A few natural synonyms (audit, harden, permissions) would strengthen trigger coverage.

Suggestions

Add an explicit trigger clause, e.g., "Use when setting up or modifying Claude Code configs (.claude/, CLAUDE.md, settings.json, MCP servers, hooks) or when the user asks to audit or harden their configuration security."

Include natural synonyms users would say — "audit", "harden", "permissions check" — to improve trigger term coverage.

Mention the auto-fix and init capabilities in the description so users know the skill can remediate issues, not just report them.

Dimension	Reasoning	Score
Specificity	"Scan your Claude Code configuration (.claude/ directory) for security vulnerabilities, misconfigurations, and injection risks" plus "Checks CLAUDE.md, settings.json, MCP servers, hooks, and agent definitions" names several concrete targets and check types. It falls short of the 5 anchor because the action verbs are limited (scan/check) rather than a comprehensive set of distinct actions, and above 3 because it enumerates five specific files and three check categories.	4 / 5
Completeness	The "what" is clear and concrete (scan Claude Code config with AgentShield, checking specific files), but there is no "Use when..." clause or equivalent trigger guidance, which caps completeness at 3 per the judging guidelines. It is not 4 because the "when" is entirely absent rather than merely imprecise.	3 / 5
Trigger Term Quality	Includes natural terms users would say such as "security vulnerabilities", "scan", "settings.json", "MCP servers", "hooks", and "injection risks", giving good keyword coverage. Not 5 because common synonyms like "audit", "harden", or "permissions check" are missing; not 3 because coverage goes well beyond a couple of generic keywords.	4 / 5
Distinctiveness Conflict Risk	"Claude Code configuration (.claude/ directory)" and the named tool AgentShield carve out a clear niche with distinct triggers. Not 5 because generic phrases like "security vulnerabilities" carry minor overlap risk with general security-review skills; not 3 because the scoping to specific config files is highly specific.	4 / 5
	Total	15 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: valeriibeck-star/claude-skills
Path: skills/security-scan/SKILL.md
Revision: 0bda8b8

Reviewed: 2 days ago

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.

security-scan

Table of Contents

Is this your skill?