spring-security-configuration

Creates a Spring Security configuration class with authentication, authorization, and HTTP protection setup. Use this skill when a security configuration needs to be created, either standalone or as part of a larger task (e.g. adding authentication to a REST API, configuring OAuth2/OIDC login, setting up JWT resource server).

Quality

73%

Does it follow best practices?

Impact

—

No eval scenarios have been run

Securityby

Passed

No known issues

Optimize this skill with Tessl

npx tessl skill review --optimize ./skills/spring-security-configuration/SKILL.md

Quality

Content

47%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

This is a comprehensive orchestration skill for Spring Security configuration that excels in workflow clarity with well-defined steps, decision trees, and validation checkpoints. However, it suffers significantly from verbosity — the same principles (context-first, smart defaults, AskUserQuestion preferences) are restated multiple times, and many instructions explain things Claude already understands (how to read conversation context, how to accept user answers). The skill would benefit greatly from condensing repeated guidance and moving detailed sub-policies into reference files.

Suggestions

Consolidate the repeated 'Decision-making principle', 'Smart defaults', 'Smart answer recognition', and 'AskUserQuestion' guidelines into a single concise section or a separate reference file — currently the same ideas appear in the Defaults table, the Decision-making principle section, and Step 0.

Remove instructions that explain things Claude already knows, such as 'Re-read the user's prompt and the prior turns of this conversation' and 'This step costs nothing' — Claude understands conversation context without being told how to use it.

Move the detailed AskUserQuestion usage rules (header length, option count, when not to use it) into a separate reference file like `references/question-guidelines.md` to keep the main skill focused on the generation workflow.

Add at least one concrete code example showing what a generated SecurityConfiguration class looks like for the most common variant (e.g., JWT), so the skill is partially self-contained even without bundle files.

Dimension	Reasoning	Score
Conciseness	The skill is extremely verbose at ~300+ lines with extensive repetition. The 'Decision-making principle' section restates the same logic multiple times (context first, smart defaults, smart answer recognition). The AskUserQuestion guidelines are repeated in multiple places. Many instructions explain things Claude already knows (how to read conversation context, how to batch questions). The anti-hallucination checklist, while useful, is very long and could be condensed.	1 / 3
Actionability	The skill provides a clear multi-step workflow with specific MCP tool names, file paths, and variable mappings. However, it contains no executable code examples — all code generation depends on external example files that are not provided in the bundle. The steps are procedural but rely heavily on references that cannot be evaluated. The authentication type mapping and MCP tool tables are concrete and useful.	2 / 3
Workflow Clarity	The workflow is clearly sequenced (Steps 0-5) with explicit validation checkpoints: checking for existing security configs and warning the user, verifying Boot version compatibility for Authorization Server, the anti-hallucination checklist before writing code, and dependency verification against presentDeps. The feedback loop for existing configs (warn → confirm → proceed or stop) is well-defined. Each step has clear inputs, outputs, and decision points.	3 / 3
Progressive Disclosure	The skill references a well-organized bundle structure (references/, examples/_skeletons/, examples/_fragments/, examples/_beans/, _dependencies/, _properties/) with clear one-level-deep navigation. However, since no bundle files are provided, we cannot verify these references exist. The SKILL.md itself is monolithic — the extensive AskUserQuestion guidelines, decision-making principles, and defaults table could be split into separate reference files to keep the main skill leaner.	2 / 3
	Total	8 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

This is a well-crafted skill description that clearly communicates what it does (creates Spring Security configuration classes) and when to use it (with explicit trigger scenarios). It uses third-person voice correctly, includes rich natural trigger terms spanning multiple Spring Security use cases, and is distinctive enough to avoid conflicts with other skills.

Dimension	Reasoning	Score
Specificity	Lists multiple specific concrete actions: 'authentication, authorization, and HTTP protection setup' and further elaborates with examples like 'adding authentication to a REST API, configuring OAuth2/OIDC login, setting up JWT resource server'.	3 / 3
Completeness	Clearly answers both 'what' (creates a Spring Security configuration class with authentication, authorization, and HTTP protection) and 'when' (explicit 'Use this skill when...' clause with multiple trigger scenarios including standalone and as part of larger tasks).	3 / 3
Trigger Term Quality	Includes strong natural keywords users would say: 'Spring Security', 'authentication', 'authorization', 'REST API', 'OAuth2', 'OIDC', 'JWT', 'resource server', 'security configuration'. These cover common variations of how users would describe this need.	3 / 3
Distinctiveness Conflict Risk	Highly specific to Spring Security configuration with distinct triggers like OAuth2/OIDC, JWT resource server, and Spring Security. Unlikely to conflict with generic coding skills or other framework-specific skills.	3 / 3
	Total	12 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 11 / 11 Passed

Validation for skill structure

No warnings or errors.

Repository: Amplicode/spring-skills
Commit: 50fc5d2

Reviewed: about 5 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.