security-scan

使用 AgentShield 扫描 Claude Code 配置（.claude/ 目录）中的安全漏洞、配置错误和注入风险。检查 CLAUDE.md、settings.json、MCP 服务端、钩子（Hooks）和智能体（Agents）定义。

Quality

61%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./docs/ja-JP/skills/security-scan/SKILL.md

Quality

Content

65%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with concrete, executable commands and a clear linear workflow, but it is a monolithic ~160-line file with no progressive disclosure to separate reference materials and lacks a verify-after-fix feedback loop. Splitting detailed reference content into bundle files and adding a re-scan verification step would improve it.

Suggestions

Move the detailed reference material (severity-levels table, full results-interpretation catalog, GitHub Action snippet, Opus deep-analysis) into one-level-deep files under references/ and link to them from the overview.

Add an explicit validation/feedback loop after auto-fix — e.g., 'After --fix, re-run npx ecc-agentshield scan to confirm findings are resolved' — to satisfy the destructive-operation workflow requirement.

Tighten the results-interpretation and Opus-analysis sections to the essential guidance, reducing token cost without losing actionability.

Dimension	Reasoning	Score
Conciseness	Most content is concrete CLI usage for a niche tool (AgentShield/ecc-agentshield) that Claude does not already know, so tokens largely earn their place, but the ~160-line body includes a full results-interpretation catalog and an Opus deep-analysis section that could be tightened, matching anchor 2 rather than 3.	2 / 3
Actionability	Provides fully executable, copy-paste-ready commands throughout — 'npx ecc-agentshield scan --fix', '--format json', '--opus --stream', 'npx ecc-agentshield init', plus a concrete GitHub Action YAML block — which matches the anchor 3 example.	3 / 3
Workflow Clarity	The scan → interpret → fix flow is sequenced and the auto-fix section states safety guardrails ('仅针对标记为可自动修复的项', '绝不修改仅限手动建议的项'), but auto-fix mutates configuration with no re-scan/verify feedback loop, so the destructive-operation guideline caps workflow clarity at 2.	2 / 3
Progressive Disclosure	Sections are well-organized with clear headers, but the skill is a monolithic single file with no bundle references (no references/, scripts/, or assets/ exist) and detailed material — the severity-levels table, results-interpretation catalog, GitHub Action, and Opus analysis — is inline rather than split into one-level-deep reference files, matching anchor 2.	2 / 3
	Total	9 / 12 Passed

Description

57%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and clearly scoped to Claude Code config security, but it is missing explicit 'when to use' trigger guidance and is written in second person rather than third person. Adding a 'Use when...' clause and rephrasing to third person would raise its score.

Suggestions

Add an explicit 'Use when...' clause (e.g., 'Use when setting up or modifying a Claude Code project, or when auditing .claude/ configuration for security issues').

Rephrase to third person ('Scans Claude Code configuration...') instead of second person ('扫描您的...') to satisfy the voice guideline and recover the specificity penalty.

Include a few more natural trigger terms users would say, such as 'audit', 'check', or '安全检查', alongside the existing keywords.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions and specific check targets ('扫描...安全漏洞、配置错误和注入风险', 'CLAUDE.md、settings.json、MCP 服务器、钩子、智能体'), which maps to anchor 3, but the description uses second person ('您的 Claude Code 配置') so the rubric's voice penalty reduces specificity by 1.	2 / 3
Completeness	Clearly answers WHAT (AgentShield scan of the .claude/ directory with specific check items) but never states WHEN to use it; per the guideline a missing 'Use when...' clause caps completeness at 2.	2 / 3
Trigger Term Quality	Contains relevant natural terms ('扫描', '安全漏洞', '配置错误', '注入风险') but misses common variations a user might say ('审计', '检查', '安全检查') and has no explicit 'Use when' trigger phrasing, so it sits at anchor 2 rather than 3.	2 / 3
Distinctiveness Conflict Risk	It targets a clear niche — security auditing of Claude Code's .claude/ configuration via AgentShield — with distinct triggers unlikely to overlap with other skills.	3 / 3
	Total	9 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: xu-xiang/everything-claude-code-zh
Path: docs/ja-JP/skills/security-scan/SKILL.md
Commit: dfbf946

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.