spring-security-configuration

Creates a Spring Security configuration class with authentication, authorization, and HTTP protection setup. Use this skill when a security configuration needs to be created, either standalone or as part of a larger task (e.g. adding authentication to a REST API, configuring OAuth2/OIDC login, setting up JWT resource server).

Quality

73%

Does it follow best practices?

Impact

—

No eval scenarios have been run

Securityby

Risky

Do not use without reviewing

Optimize this skill with Tessl

npx tessl skill review --optimize ./skills/spring-security-configuration/SKILL.md

Quality

Discovery

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

This is a well-crafted skill description that clearly communicates what it does (creates Spring Security configuration classes) and when to use it (with explicit trigger scenarios). It uses third-person voice, includes rich natural trigger terms spanning multiple security paradigms (OAuth2, OIDC, JWT), and is distinctive enough to avoid conflicts with other skills.

Dimension	Reasoning	Score
Specificity	Lists multiple specific concrete actions: 'authentication, authorization, and HTTP protection setup' and further elaborates with examples like 'adding authentication to a REST API, configuring OAuth2/OIDC login, setting up JWT resource server'.	3 / 3
Completeness	Clearly answers both 'what' (creates a Spring Security configuration class with authentication, authorization, and HTTP protection) and 'when' (explicit 'Use this skill when...' clause with multiple trigger scenarios including standalone and as part of larger tasks).	3 / 3
Trigger Term Quality	Includes strong natural keywords users would say: 'Spring Security', 'authentication', 'authorization', 'REST API', 'OAuth2', 'OIDC', 'JWT', 'resource server', 'security configuration'. These cover common variations of how users would describe this need.	3 / 3
Distinctiveness Conflict Risk	Highly specific to Spring Security configuration with distinct triggers like OAuth2/OIDC, JWT resource server, and Spring Security. Unlikely to conflict with generic coding skills or other framework-specific skills.	3 / 3
	Total	12 / 12 Passed

Implementation

47%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The skill demonstrates strong workflow design with clear step sequencing, validation checkpoints, and a comprehensive anti-hallucination checklist. However, it suffers significantly from verbosity — decision-making principles, question-asking rules, and smart-default logic are repeated multiple times across different sections, inflating the token cost substantially. The content would benefit from aggressive deduplication and moving meta-instructions (how to ask questions, how to recognize user intent) into a separate reference file or eliminating them entirely since Claude already understands these patterns.

Suggestions

Deduplicate the question-asking logic: the 'Decision-making principle', 'How to ask', 'Smart defaults', 'Smart answer recognition', 'Batch questions', and Step 0 sections all cover overlapping ground. Consolidate into a single concise section of ~15 lines.

Remove instructions that teach Claude things it already knows, such as how to recognize when a user has already answered a question, how to accept direct values instead of numbered choices, and how to batch related questions — these are general conversational competencies.

Move the detailed 'Decision-making principle' and 'AskUserQuestion' rules into a separate reference file (e.g., `references/interaction-rules.md`) to keep SKILL.md as a lean overview.

Add at least one inline code example showing what a generated SecurityConfiguration class looks like for the most common variant (e.g., JWT), so the skill has concrete executable output visible without needing bundle files.

Dimension	Reasoning	Score
Conciseness	The skill is extremely verbose at ~300+ lines with significant redundancy. The 'Decision-making principle' section repeats the same logic about AskUserQuestion multiple times. The 'Smart defaults' and 'Smart answer recognition' sections overlap with Step 0. Rules about when to ask vs. not ask are restated in at least 3 places. Much of this content (how to batch questions, how to recognize user intent) describes things Claude already knows how to do.	1 / 3
Actionability	The skill provides concrete MCP tool calls, specific file paths (e.g., `examples/_skeletons/{lang}.md`, `references/jwt.md`), and a clear mapping from authentication types to reference files. However, no actual executable code examples are shown inline — everything depends on external files that aren't provided. The anti-hallucination checklist and DSL ordering rules are specific and actionable, but the skill is more of a process description than copy-paste-ready guidance.	2 / 3
Workflow Clarity	The workflow is clearly sequenced across Steps 0-5 with explicit validation checkpoints (anti-hallucination checklist, existing config warning, version compatibility checks, dependency verification via refresh_build_system_model). The feedback loop for existing configurations (warn → confirm → proceed or stop) and the version-gating for Authorization Server (bootMajor >= 3.1) are well-defined validation steps.	3 / 3
Progressive Disclosure	The skill references a well-organized bundle structure (references/, examples/_skeletons/, examples/_fragments/, examples/_beans/, _dependencies/, _properties/) with clear one-level-deep navigation. However, no bundle files were provided to verify these references exist, and the SKILL.md itself is a monolithic wall of text that inlines extensive decision-making logic, question-asking rules, and anti-hallucination checklists that could be split into separate reference files.	2 / 3
	Total	8 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 11 / 11 Passed

Validation for skill structure

No warnings or errors.

Repository: Amplicode/spring-skills
Commit: 1dd96ad

Reviewed: 11 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.