quarkus-security

Quarkus Security best practices for authentication, authorization, JWT/OIDC, RBAC, input validation, CSRF, secrets management, and dependency security. Use when reviewing Quarkus authn/authz, JWT or OIDC, RBAC, validation, or secrets.

Quality

81%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

71%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, code-dense security reference covering the major Quarkus security domains with executable examples. Its main weaknesses are a redundant best-practices list and a monolithic single-file structure that would benefit from reference-file splits.

Suggestions

Remove or deduplicate the 'Best Practices' bullet list, which restates the 'When to Activate' section and the opening description, to tighten conciseness.

Split bulkier reference material (e.g., SQL injection patterns, audit logging, dependency scanning) into separate reference files under references/ and link to them from the body to improve progressive disclosure.

Either implement or explicitly justify the validateToken stub in CustomAuthFilter so the example is fully executable rather than implying a placeholder.

Dimension	Reasoning	Score
Conciseness	Mostly efficient code with minimal concept padding, but the 'Best Practices' list largely restates the 'When to Activate' list and the opening sentence duplicates the description, adding tokens that could be trimmed.	3 / 5
Actionability	Copy-paste-ready Java, properties, and bash examples comprehensively cover the common cases (JWT resources, @RolesAllowed, Bean Validation records, parameterized Panache queries, BCrypt, CORS, Vault, rate-limit filter, security headers, OWASP dependency-check).	5 / 5
Workflow Clarity	A 'When to Activate' entry point routes to a well-organized topic catalog and the 'Best Practices' section doubles as a verification checklist ('Test authentication and authorization paths'), giving clear guidance with minor gaps since this is a pattern reference rather than a sequential workflow.	4 / 5
Progressive Disclosure	At ~460 inlined lines it exceeds the simple-skill threshold and keeps everything in one file with no external reference split; section headers provide structure but bulkier topics (SQL injection, audit logging, dependency scanning) could live in reference files.	3 / 5
	Total	15 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that clearly answers both what the skill does and when to trigger it, with natural developer-facing keywords. Minor trigger-term synonym coverage could be expanded.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete security domains (authentication, authorization, JWT/OIDC, RBAC, input validation, CSRF, secrets management, dependency security), giving comprehensive coverage rather than just naming the domain.	5 / 5
Completeness	Explicitly states what it does (best practices across a named domain list) and when to use it via a concrete 'Use when reviewing...' clause with multiple trigger phrases.	5 / 5
Trigger Term Quality	Natural trigger terms ('authn/authz', 'JWT or OIDC', 'RBAC', 'validation', 'secrets') match what developers say, but several natural synonyms and topics in the what-list (CORS, security headers, password hashing) are absent from the trigger clause.	4 / 5
Distinctiveness Conflict Risk	'Quarkus Security' is a clear niche with Quarkus-specific trigger terms, making it distinct from generic security or other framework skills with minimal conflict risk.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: affaan-m/ECC
Path: skills/quarkus-security/SKILL.md
Commit: d8409a4

Reviewed: 1 day ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.