Scan a Claude Skill for dangerous shell commands, hardcoded secrets, or prompt-injection phrases. Returns findings with excerpts.
| Name | Required | Description | Default |
|---|---|---|---|
| skill_md | Yes | The skill text to scan for security issues |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the transparency burden. It discloses that the tool scans for specific security issues and returns findings with excerpts, but it does not explicitly state whether the scan is read-only, requires authentication, or has limitations. It adds some value but not comprehensive behavioral detail.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences front-load the purpose and output. Every piece of information earns its place, with no redundancy or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter tool with no output schema, the description covers the main purpose and states that it returns findings with excerpts. It could be more specific about the structure of findings, but it is sufficiently complete for an agent to select and invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for the single 'skill_md' parameter, so the schema already documents its meaning. The description does not add further semantic detail about the parameter itself, only naming target threats, which is not directly about the parameter's format or usage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Scan') and a clear resource ('Claude Skill') while enumerating precise scan targets (dangerous shell commands, hardcoded secrets, prompt-injection phrases). This clearly distinguishes it from sibling tools like lint_frontmatter, score_skill, and validate_skill.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context for when to use the tool (security scanning of skills) but does not explicitly state exclusions or alternative tools. It is evident that this is for security analysis rather than linting or scoring, but there is no direct 'use this instead of X' guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Add one secure layer between your agents and this server.
Most tools are distinct, but score_skill and validate_skill both run full validation and return score/gate, creating overlap. Descriptions help by distinguishing minimal CI/CD payload from detailed structured errors, but the boundaries are not instantly clear.
All tool names follow a consistent verb_noun snake_case pattern: lint_frontmatter, scan_security, score_skill, validate_skill. This is highly predictable and easy to reason about.
Four tools is an appropriate size for a validation server, covering specific checks and a full validation without bloat or thinness.
The server covers frontmatter linting, security scanning, scoring, and full validation including tool collision checks. No obvious missing operations for the stated purpose of validating Claude Skills.