luongnv89/claude-howto mcp skill
learning guide
Claude How To is a structured learning guide for Claude Code that covers 10 feature modules from slash commands to plugins, with visual diagrams, copy-paste templates, and a progressive curriculum. It provides production-ready examples and a guided learning path designed to take developers from beginner to power user in 11-13 hours.
Follow the guided learning path to systematically master Claude Code features in recommended order Copy template configurations directly into your project for slash commands, skills, hooks, and MCP setups Run self-assessment quizzes to identify knowledge gaps and get a personalized learning roadmap Reference real-world use case examples for code review, CI/CD, documentation, and refactoring workflows Use the feature catalog and CLI reference when you need specific syntax or installation commands ⚠ REVIEW
Risk score 55/100
38 HIGH✓ 10 MEDIUM 28 LOW
✓ CRITICAL/HIGH reflect AI-verified findings (false positives excluded) · MEDIUM/LOW/INFO are unverified scanner output
AI-verified (CRITICAL/HIGH): 16 confirmed (42%) 22 likely real (58%) 28 false positive — excluded from CRITICAL/HIGH count above
Findings by checker · 3 high-signal, 5 mostly false-positive (hidden by default)
CHK-144 16 findings 16 confirmed
0% FP CHK-047 1 finding 1 likely
0% FP CHK-049 1 finding 1 likely
0% FP ▼ Show 5 checkers that are mostly false positives (48 findings) 76 findings click to expand
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in scripts/build_epub.py
scripts/build_epub.py
AI: likely real likely ▼
CHK-125 execSync() — synchronous shell execution — no scope constraint in hooks/pre-review.js
07-plugins/pr-review/hooks/pre-review.js
AI: likely real likely ▼
CHK-125 execSync() — synchronous shell execution — no scope constraint in hooks/pre-deploy.js
07-plugins/devops-automation/hooks/pre-deploy.js
AI: likely real likely ▼
CHK-125 execSync() — synchronous shell execution — no scope constraint in hooks/post-deploy.js
07-plugins/devops-automation/hooks/post-deploy.js
AI: likely real likely ▼
CHK-125 kubectl invocation — cluster command execution — no scope constraint in scripts/deploy.sh
07-plugins/devops-automation/scripts/deploy.sh
AI: likely real likely ▼
CHK-125 kubectl invocation — cluster command execution — no scope constraint in scripts/rollback.sh
07-plugins/devops-automation/scripts/rollback.sh
AI: likely real likely ▼
CHK-125 execSync() — synchronous shell execution — no scope constraint in hooks/pre-review.js
uk/07-plugins/pr-review/hooks/pre-review.js
AI: likely real likely ▼
CHK-125 execSync() — synchronous shell execution — no scope constraint in hooks/pre-deploy.js
uk/07-plugins/devops-automation/hooks/pre-deploy.js
AI: likely real likely ▼
CHK-125 execSync() — synchronous shell execution — no scope constraint in hooks/post-deploy.js
uk/07-plugins/devops-automation/hooks/post-deploy.js
AI: likely real likely ▼
CHK-125 kubectl invocation — cluster command execution — no scope constraint in scripts/health-check.sh
uk/07-plugins/devops-automation/scripts/health-check.sh
AI: likely real likely ▼
CHK-125 kubectl invocation — cluster command execution — no scope constraint in scripts/deploy.sh
uk/07-plugins/devops-automation/scripts/deploy.sh
AI: likely real likely ▼
CHK-125 kubectl invocation — cluster command execution — no scope constraint in scripts/rollback.sh
uk/07-plugins/devops-automation/scripts/rollback.sh
AI: likely real likely ▼
CHK-047 Potential SSRF — user-controlled URL passed to HTTP client in scripts/vendor_assets.py
scripts/vendor_assets.py
AI: likely real likely ▼
CHK-125 execSync() — synchronous shell execution — no scope constraint in hooks/pre-review.js
vi/07-plugins/pr-review/hooks/pre-review.js
AI: likely real likely ▼
CHK-125 execSync() — synchronous shell execution — no scope constraint in hooks/pre-deploy.js
vi/07-plugins/devops-automation/hooks/pre-deploy.js
AI: likely real likely ▼
CHK-125 execSync() — synchronous shell execution — no scope constraint in hooks/post-deploy.js
vi/07-plugins/devops-automation/hooks/post-deploy.js
AI: likely real likely ▼
CHK-125 kubectl invocation — cluster command execution — no scope constraint in scripts/health-check.sh
vi/07-plugins/devops-automation/scripts/health-check.sh
AI: likely real likely ▼
CHK-125 kubectl invocation — cluster command execution — no scope constraint in scripts/deploy.sh
vi/07-plugins/devops-automation/scripts/deploy.sh
AI: likely real likely ▼
CHK-125 kubectl invocation — cluster command execution — no scope constraint in scripts/rollback.sh
vi/07-plugins/devops-automation/scripts/rollback.sh
AI: likely real likely ▼
CHK-114 Cyrillic homoglyph substitution detected in skill file
uk/03-skills/brand-voice/SKILL.md
AI: likely real likely ▼
CHK-144 'filesystem' invoked via npx with no version pin — rug pull risk
05-mcp/filesystem-mcp.json
AI: confirmed likely ▼
CHK-144 'database' invoked via npx with no version pin — rug pull risk
05-mcp/database-mcp.json
AI: confirmed likely ▼
CHK-144 'github' invoked via npx with no version pin — rug pull risk
05-mcp/multi-mcp.json
AI: confirmed likely ▼
CHK-144 'github' invoked via npx with no version pin — rug pull risk
05-mcp/github-mcp.json
AI: confirmed likely ▼
CHK-144 'filesystem' invoked via npx with no version pin — rug pull risk
uk/05-mcp/filesystem-mcp.json
AI: confirmed likely ▼
CHK-144 'database' invoked via npx with no version pin — rug pull risk
uk/05-mcp/database-mcp.json
AI: confirmed likely ▼
CHK-144 'github' invoked via npx with no version pin — rug pull risk
uk/05-mcp/multi-mcp.json
AI: confirmed likely ▼
CHK-144 'github' invoked via npx with no version pin — rug pull risk
uk/05-mcp/github-mcp.json
AI: confirmed likely ▼
CHK-144 'filesystem' invoked via npx with no version pin — rug pull risk
ja/05-mcp/filesystem-mcp.json
AI: confirmed likely ▼
CHK-144 'database' invoked via npx with no version pin — rug pull risk
ja/05-mcp/database-mcp.json
AI: confirmed likely ▼
CHK-144 'github' invoked via npx with no version pin — rug pull risk
ja/05-mcp/multi-mcp.json
AI: confirmed likely ▼
CHK-144 'github' invoked via npx with no version pin — rug pull risk
ja/05-mcp/github-mcp.json
AI: confirmed likely ▼
CHK-144 'filesystem' invoked via npx with no version pin — rug pull risk
vi/05-mcp/filesystem-mcp.json
AI: confirmed likely ▼
CHK-144 'database' invoked via npx with no version pin — rug pull risk
vi/05-mcp/database-mcp.json
AI: confirmed likely ▼
CHK-144 'github' invoked via npx with no version pin — rug pull risk
vi/05-mcp/multi-mcp.json
AI: confirmed likely ▼
CHK-144 'github' invoked via npx with no version pin — rug pull risk
vi/05-mcp/github-mcp.json
AI: confirmed likely ▼
CHK-049 No OAuth 2.0 or API key validation detected in server source
AI: likely real possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in scripts/check_mermaid.py
scripts/check_mermaid.py
AI: likely real likely ▼
CHK-125b sudo invocation — privilege escalation — no scope constraint in 06-hooks/README.md
ja/06-hooks/README.md
possible ▼
CHK-125b sudo invocation — privilege escalation — no scope constraint in 09-advanced-features/README.md
ja/09-advanced-features/README.md
possible ▼
CHK-125b sudo invocation — privilege escalation — no scope constraint in 09-advanced-features/README.md
uk/09-advanced-features/README.md
possible ▼
CHK-125b sudo invocation — privilege escalation — no scope constraint in 06-hooks/README.md
06-hooks/README.md
possible ▼
CHK-125b sudo invocation — privilege escalation — no scope constraint in 06-hooks/README.md
vi/06-hooks/README.md
possible ▼
CHK-125b sudo invocation — privilege escalation — no scope constraint in 06-hooks/pre-tool-check.sh
06-hooks/pre-tool-check.sh
possible ▼
CHK-125b sudo invocation — privilege escalation — no scope constraint in 06-hooks/pre-tool-check.sh
uk/06-hooks/pre-tool-check.sh
possible ▼
CHK-125b sudo invocation — privilege escalation — no scope constraint in 06-hooks/README.md
uk/06-hooks/README.md
possible ▼
CHK-125b sudo invocation — privilege escalation — no scope constraint in references/question-bank.md
.claude/skills/lesson-quiz/references/question-bank.md
possible ▼
CHK-125b sudo invocation — privilege escalation — no scope constraint in 06-hooks/pre-tool-check.sh
ja/06-hooks/pre-tool-check.sh
possible ▼
CHK-125c requests.* — unconstrained HTTP — no scope constraint in doc-generator/SKILL.md
zh/03-skills/doc-generator/SKILL.md
possible ▼
CHK-125c requests.* — unconstrained HTTP — no scope constraint in templates/api-endpoint.md
ja/07-plugins/documentation/templates/api-endpoint.md
possible ▼
CHK-125c requests.* — unconstrained HTTP — no scope constraint in doc-generator/SKILL.md
ja/03-skills/doc-generator/SKILL.md
possible ▼
CHK-125c requests.* — unconstrained HTTP — no scope constraint in templates/api-endpoint.md
vi/07-plugins/documentation/templates/api-endpoint.md
possible ▼
CHK-025 Hardcoded endpoint in skill: https://api.example.com/api/v1/users/usr_123
03-skills/doc-generator/SKILL.md
possible ▼
CHK-025 Hardcoded endpoint in skill: https://api.example.com/api/v1/users/usr_123
uk/03-skills/doc-generator/SKILL.md
likely ▼
CHK-025 Hardcoded endpoint in skill: https://api.example.com/api/v1/users/usr_123
zh/03-skills/doc-generator/SKILL.md
possible ▼
CHK-025 Hardcoded endpoint in skill: https://api.example.com/api/v1/users/usr_123
ja/03-skills/doc-generator/SKILL.md
possible ▼
CHK-032 Agent 'code-commentator' has no explicit 'cannot do' boundary
07-plugins/documentation/agents/code-commentator.md
possible ▼
CHK-032 Agent 'api-documenter' has no explicit 'cannot do' boundary
07-plugins/documentation/agents/api-documenter.md
possible ▼
CHK-032 Agent 'CLAUDE' has no explicit 'cannot do' boundary
vi/CLAUDE.md
possible ▼
CHK-032 Agent 'security-reviewer' has no explicit 'cannot do' boundary
07-plugins/pr-review/agents/security-reviewer.md
possible ▼
CHK-032 Agent 'performance-analyzer' has no explicit 'cannot do' boundary
07-plugins/pr-review/agents/performance-analyzer.md
possible ▼
CHK-032 Agent 'test-checker' has no explicit 'cannot do' boundary
07-plugins/pr-review/agents/test-checker.md
possible ▼
CHK-032 Agent 'incident-commander' has no explicit 'cannot do' boundary
07-plugins/devops-automation/agents/incident-commander.md
possible ▼
CHK-032 Agent 'alert-analyzer' has no explicit 'cannot do' boundary
07-plugins/devops-automation/agents/alert-analyzer.md
possible ▼
CHK-032 Agent 'deployment-specialist' has no explicit 'cannot do' boundary
07-plugins/devops-automation/agents/deployment-specialist.md
possible ▼
CHK-125c requests.* — unconstrained HTTP — no scope constraint in ja/claude_concepts_guide.md
ja/claude_concepts_guide.md
possible ▼
CHK-125c requests.* — unconstrained HTTP — no scope constraint in claude_concepts_guide.md
claude_concepts_guide.md
possible ▼
CHK-125c requests.* — unconstrained HTTP — no scope constraint in uk/claude_concepts_guide.md
uk/claude_concepts_guide.md
possible ▼
CHK-125c urllib.request — unconstrained HTTP — no scope constraint in scripts/check_links.py
scripts/check_links.py
possible ▼
CHK-125c urllib.request — unconstrained HTTP — no scope constraint in scripts/vendor_assets.py
scripts/vendor_assets.py
possible ▼
CHK-032 Agent 'example-generator' has no explicit 'cannot do' boundary
07-plugins/documentation/agents/example-generator.md
possible ▼
CHK-125c requests.* — unconstrained HTTP — no scope constraint in templates/api-endpoint.md
07-plugins/documentation/templates/api-endpoint.md
possible ▼
CHK-125c requests.* — unconstrained HTTP — no scope constraint in doc-generator/SKILL.md
03-skills/doc-generator/SKILL.md
possible ▼
CHK-125c requests.* — unconstrained HTTP — no scope constraint in templates/api-endpoint.md
uk/07-plugins/documentation/templates/api-endpoint.md
possible ▼
CHK-125c requests.* — unconstrained HTTP — no scope constraint in doc-generator/SKILL.md
uk/03-skills/doc-generator/SKILL.md
possible ▼
CHK-125c requests.* — unconstrained HTTP — no scope constraint in templates/api-endpoint.md
zh/07-plugins/documentation/templates/api-endpoint.md
possible ▼
▼ Show 28 false positives (27% of this view) Last scanned: Jun 3, 2026
More servers
google-gemini/gemini-cli 85
An open-source AI agent that brings the power of Gemini directly into your terminal.
106k★
skypilot-org/skypilot 85
obra/superpowers 85
Foundational skill pack by Jesse Vincent now in anthropics/claude-plugins-official. Includes ffuf web-fuzzing/pentest skill. Partial analysis done — full hook and plugin inspection pending. tier=T2
191k★
Significant-Gravitas/AutoGPT 85
AutoGPT is the vision of accessible AI for everyone, to use and to build on. Our mission is to provide the tools, so that you can focus on what matters.
186k★
nanocoai/nanoclaw 85
A lightweight alternative to OpenClaw that runs in containers for security. Connects to WhatsApp, Telegram, Slack, Discord, Gmail and other messaging apps,, has memory, scheduled jobs, and runs directly on Anthropic's Agents SDK
30k★
google-gemini/gemini-cli 85
An open-source AI agent that brings the power of Gemini directly into your terminal.
106k★
Scan your entire org's MCP deployment
2,500+ repos pre-scored. 22% carry CRITICAL findings.