quarkus-security

Quarkus Security best practices for authentication, authorization, JWT/OIDC, RBAC, input validation, CSRF, secrets management, and dependency security.

Quality

73%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/quarkus-security/SKILL.md

Quality

Content

65%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with concrete, executable Quarkus security code and clear BAD/GOOD contrasts, but it is a long monolithic reference lacking sequenced workflows with validation and any progressive disclosure into separate files.

Suggestions

Split detailed sections (e.g., JWT/OIDC, Vault integration, security headers) into reference files linked from a concise overview in SKILL.md to improve progressive disclosure.

For destructive or batch operations (e.g., deleting users, dependency remediation), add explicit validation checkpoints and feedback loops to lift workflow clarity.

Trim full-class boilerplate (imports, class scaffolding) in examples to the essential lines to improve token efficiency.

Dimension	Reasoning	Score
Conciseness	The body avoids concept-explanation fluff and is mostly lean code, but at ~460 lines it includes full class wrappers, imports, and annotations that could be tightened, so not every token earns its place.	2 / 3
Actionability	Extensive executable Java using real Quarkus APIs (JsonWebToken, SecurityIdentity, BcryptUtil, Panache, Bean Validation), real application.properties keys, and real CLI commands — copy-paste ready with concrete BAD/GOOD contrasts.	3 / 3
Workflow Clarity	Content is a pattern catalog organized by topic rather than a sequenced multi-step workflow, and there are no explicit validation checkpoints or feedback loops for destructive or batch operations.	2 / 3
Progressive Disclosure	All content lives inline in a single large file with no bundle references to split out detail; sections are well-organized with clear headers, but a ~460-line monolithic doc should offload detail to separate reference files.	2 / 3
	Total	9 / 12 Passed

Description

82%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and distinctive, naming many concrete Quarkus security capabilities with natural trigger terms. Its main weakness is the absence of an explicit "Use when..." trigger clause, which limits completeness.

Suggestions

Add an explicit trigger clause such as "Use when securing Quarkus applications with authentication, authorization, or input validation" to satisfy the "when" half of completeness.

Lead with concrete action verbs (e.g., "Secure", "Validate", "Hash") rather than the noun phrase "best practices for" to sharpen specificity.

Dimension	Reasoning	Score
Specificity	Enumerates multiple concrete capability domains — "authentication, authorization, JWT/OIDC, RBAC, input validation, CSRF, secrets management, and dependency security" — matching the anchor for listing several specific concrete capabilities.	3 / 3
Completeness	The "what" is clearly and comprehensively stated, but there is no "Use when..." clause or equivalent explicit trigger guidance, which caps completeness at 2 per the judging guidelines.	2 / 3
Trigger Term Quality	Terms like "authentication", "authorization", "JWT/OIDC", "CSRF", and "secrets management" are exactly the natural language a developer would say when needing this skill, giving good coverage.	3 / 3
Distinctiveness Conflict Risk	"Quarkus Security" is a clear niche scoped to a specific framework plus security concerns, with distinct triggers unlikely to conflict with non-Quarkus or non-security skills.	3 / 3
	Total	11 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: affaan-m/ECC
Path: skills/quarkus-security/SKILL.md
Commit: 754b8dd

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.