CtrlK
BlogDocsLog inGet started
Tessl Logo

security-scan

使用 AgentShield 扫描 Claude Code 配置(.claude/ 目录)中的安全漏洞、配置错误和注入风险。检查 CLAUDE.md、settings.json、MCP 服务端、钩子(Hooks)和智能体(Agents)定义。

63

Quality

73%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./docs/ja-JP/skills/security-scan/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

80%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable and token-efficient, with copy-paste commands and no conceptual padding. Its main gaps are the absence of a validation feedback loop around the destructive --fix operation and a monolithic structure with no progressive disclosure to reference files.

Suggestions

Add an explicit verify step after --fix (e.g., 're-run the scan to confirm findings are resolved') to close the destructive-operation feedback loop.

Move the detailed 结果解读 and full command-flag reference into a reference file linked from the body to enable progressive disclosure.

Sequence the primary workflow explicitly (scan → interpret severity → fix critical/high → re-scan to verify) with numbered steps and a validation checkpoint.

DimensionReasoningScore

Conciseness

The body is lean reference material — executable commands in code blocks and tables — and does not explain concepts Claude already knows; every section (启动时机, 扫描对象, usage, severity) earns its place.

3 / 3

Actionability

Fully executable, copy-paste-ready commands throughout (`npx ecc-agentshield scan`, `--fix`, `--opus`, `init`) plus a complete GitHub Action YAML block.

3 / 3

Workflow Clarity

The core scan action is unambiguous, but the destructive `--fix` step and the scan→interpret→fix flow lack an explicit validation/re-scan checkpoint, capping workflow clarity at 2 per the destructive-operations guideline.

2 / 3

Progressive Disclosure

Well-organized into clear sections, but it is a monolithic single SKILL.md with no bundle files; detailed result interpretation and command-flag reference that could live in separate files are kept inline.

2 / 3

Total

10

/

12

Passed

Description

67%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and occupies a clear, distinctive niche, but it omits an explicit 'when to use' trigger clause, which caps completeness and leaves trigger-term coverage incomplete.

Suggestions

Add an explicit 'Use when...' trigger clause (e.g., 'Use when setting up or modifying a Claude Code project's .claude/ configuration, or before committing config changes').

Broaden trigger terms to include natural user phrasings like 'audit', 'security check', or 'hardening'.

Keep the third-person voice but pair each named target with the user-facing scenario that would invoke the scan.

DimensionReasoningScore

Specificity

Lists multiple concrete actions across named targets — '扫描...安全漏洞、配置错误和注入风险' and explicit checks of 'CLAUDE.md、settings.json、MCP 服务端、钩子(Hooks)和智能体(Agents)定义'.

3 / 3

Completeness

Clearly states what the skill does, but there is no 'Use when...' clause or equivalent trigger guidance, so per rubric guidelines completeness is capped at 2.

2 / 3

Trigger Term Quality

Relevant terms like '安全漏洞', '配置错误', '注入风险' are natural, but coverage is technical and misses common variations like 'audit' or 'security check'; no explicit trigger phrasing.

2 / 3

Distinctiveness Conflict Risk

A narrow niche — AgentShield-based security auditing of Claude Code's .claude/ configuration — with distinct, specific triggers unlikely to overlap with other skills.

3 / 3

Total

10

/

12

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
xu-xiang/everything-claude-code-zh
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.