tdg-personal/security-scan
Scan your Claude Code configuration (.claude/ directory) for security vulnerabilities, misconfigurations, and injection risks using AgentShield. Checks CLAUDE.md, settings.json, MCP servers, hooks, and agent definitions.
78
78%
Does it follow best practices?
Impact
Pending
No eval scenarios have been run
Advisory
Suggest reviewing before use
Quality
Discovery
82%Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.
This is a strong description with excellent specificity and distinctiveness, clearly enumerating what it scans and what it looks for. The main weakness is the absence of an explicit 'Use when...' clause, which would help Claude know exactly when to select this skill. The trigger terms are naturally phrased and cover the domain well.
Suggestions
Add an explicit 'Use when...' clause, e.g., 'Use when the user asks to audit, scan, or review their Claude Code configuration for security issues, or mentions AgentShield, injection risks, or MCP server safety.'
| Dimension | Reasoning | Score |
|---|---|---|
Specificity | Lists multiple specific concrete actions: 'scan configuration', 'security vulnerabilities', 'misconfigurations', 'injection risks', and enumerates specific targets: 'CLAUDE.md, settings.json, MCP servers, hooks, and agent definitions'. | 3 / 3 |
Completeness | Clearly answers 'what does this do' (scan configuration for security issues) but lacks an explicit 'Use when...' clause or equivalent trigger guidance. The when is only implied by the nature of the actions described. | 2 / 3 |
Trigger Term Quality | Includes strong natural trigger terms users would say: 'security vulnerabilities', 'misconfigurations', 'injection risks', 'AgentShield', '.claude/ directory', 'CLAUDE.md', 'settings.json', 'MCP servers', 'hooks'. These cover the domain well and match how users would describe security scanning needs. | 3 / 3 |
Distinctiveness Conflict Risk | Highly distinctive — targets a very specific niche (Claude Code configuration security scanning with AgentShield). The combination of 'AgentShield', '.claude/ directory', and specific file types like 'CLAUDE.md' and 'settings.json' makes it unlikely to conflict with other skills. | 3 / 3 |
Total | 11 / 12 Passed |
Implementation
64%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
This is a well-written, highly actionable skill with excellent concrete examples and command-line usage patterns. Its main weaknesses are the lack of an explicit end-to-end workflow with validation checkpoints (especially after --fix operations) and some inline reference content that could be split out or trimmed. The 'When to Activate' and detailed severity interpretation sections add bulk without proportional value for Claude.
Suggestions
Add an explicit end-to-end workflow section: scan → review → fix → re-scan → verify grade improvement, with a checkpoint after --fix to confirm no regressions.
Trim or remove the 'When to Activate' section — Claude can infer appropriate activation contexts from the skill description.
Move the detailed 'Interpreting Results' severity breakdown to a separate SEVERITY_GUIDE.md and link to it, keeping only a brief summary inline.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The content is mostly efficient but includes some sections that could be tightened. The 'When to Activate' section is somewhat unnecessary (Claude can infer when to use a security scanner), and the severity levels table and 'Interpreting Results' section, while useful, add significant length. The 'What It Scans' table is borderline — helpful for orientation but Claude could discover this from tool output. | 2 / 3 |
Actionability | Excellent actionability with fully executable, copy-paste ready commands throughout. Every feature (basic scan, output formats, auto-fix, deep analysis, init, CI integration) has concrete command examples with clear flags and expected behaviors. | 3 / 3 |
Workflow Clarity | While individual commands are clear, there's no explicit workflow sequence tying the steps together (e.g., scan → review findings → fix → re-scan → verify). The auto-fix section mentions what it does but lacks a validation/re-scan step afterward. For a security scanning tool that can modify configs (--fix), a feedback loop (fix → re-validate) should be explicit. | 2 / 3 |
Progressive Disclosure | The content is well-structured with clear headers and tables, but it's somewhat monolithic — the 'Interpreting Results' section with all severity level details could be in a separate reference file. The skill links to external GitHub/npm pages but doesn't split its own content across files despite being ~130 lines with substantial reference material inline. | 2 / 3 |
Total | 9 / 12 Passed |
Validation
90%Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.
Validation — 10 / 11 Passed
Validation for skill structure
| Criteria | Description | Result |
|---|---|---|
frontmatter_unknown_keys | Unknown frontmatter key(s) found; consider removing or moving to metadata | Warning |
Total | 10 / 11 Passed | |
Reviewed
Table of Contents