springboot-security

Spring Security best practices for authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services.

1.29x

Quality

75%

Does it follow best practices?

Impact

96%

1.29x

Average score across 3 eval scenarios

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./docs/ja-JP/skills/springboot-security/SKILL.md

Quality

Content

86%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A lean, highly actionable security review skill with concrete code, named tools, and a useful pre-release checklist, organized into clear self-contained sections.

Dimension	Reasoning	Score
Conciseness	The body is bullet-driven and assumes Claude's knowledge with no padding about what Spring Security is; the full JwtAuthFilter class is somewhat long for an overview but otherwise every section earns its place, so just above a 3.	4 / 5
Actionability	Highly actionable: copy-paste Java snippets (JwtAuthFilter, csrf/session config, security headers), specific annotations (@EnableMethodSecurity, @PreAuthorize, @Valid, @NotBlank), and named tools (Bucket4j, OWASP Dependency Check, Snyk) cover the common cases.	5 / 5
Workflow Clarity	The pre-release checklist (リリース前チェックリスト) provides a clear verification checkpoint and the topic sections are well sequenced, but there is no explicit validate→fix→retry feedback loop; this is advisory rather than destructive, so the 3-cap does not apply.	4 / 5
Progressive Disclosure	Self-contained single file with clear, well-organized section headers (認証, 認可, 入力検証, etc.) and no nested or buried references; no bundle files are needed for this cohesive review checklist.	5 / 5
	Total	18 / 20 Passed

Description

65%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, well-scoped description with strong trigger terms and low conflict risk, but it lacks an explicit 'Use when...' trigger clause and uses topic enumeration rather than concrete action verbs.

Suggestions

Add a 'Use when...' clause naming natural triggers, e.g. 'Use when adding authentication, securing endpoints, handling secrets, or reviewing Spring Boot services for security.'

Reframe the topic list with concrete action verbs (e.g. 'Configure authentication, enforce authorization, validate input, harden headers') rather than 'best practices for ...'.

Dimension	Reasoning	Score
Specificity	The description enumerates many concrete security topics ("authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security") but frames them as "best practices for..." with no concrete verbs/actions, fitting the 'names domain and concrete areas but not framed as actions' anchor.	3 / 5
Completeness	It clearly states WHAT the skill covers but has no "Use when..." trigger clause in the description (the 'when' guidance lives only in the body), so per the missing-trigger cap completeness is held at 3.	3 / 5
Trigger Term Quality	Strong natural keywords a user would say ("Spring Security", "CSRF", "rate limiting", "secrets", "Java Spring Boot") with good coverage; a few common synonyms (e.g. "authentication/authorization", "login", "permissions") are absent, so not a 5.	4 / 5
Distinctiveness Conflict Risk	The niche is sharply defined — "Spring Security best practices ... in Java Spring Boot services" — making it unlikely to trigger for unrelated skills, matching the clear-niche/minimal-conflict anchor.	5 / 5
	Total	15 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: affaan-m/ECC
Path: docs/ja-JP/skills/springboot-security/SKILL.md
Commit: e04ea0b

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.