springboot-security

Java Spring Boot 服务中认证/授权、验证、CSRF、密钥、标头、速率限制和依赖安全性的 Spring Security 最佳实践。

1.08x

Quality

56%

Does it follow best practices?

Impact

100%

1.08x

Average score across 6 eval scenarios

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./docs/zh-CN/skills/springboot-security/SKILL.md

Quality

Content

64%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

This is a solid, actionable Spring Security reference skill with excellent code examples covering authentication, authorization, input validation, CSRF, secrets management, and more. Its main weaknesses are the monolithic structure (all topics in one file without progressive disclosure) and the lack of an explicit review workflow with validation checkpoints. Some minor verbosity exists in explaining concepts Claude already understands, but overall the content is practical and well-organized.

Suggestions

Add an explicit security review workflow sequence (e.g., 'Step 1: Check authentication config → Step 2: Verify authorization guards → ... → Step N: Run dependency scan') with validation checkpoints between steps.

Split detailed code examples for individual topics (rate limiting, CORS, security headers) into separate reference files and link to them from the main SKILL.md overview.

Remove explanatory phrases Claude already knows (e.g., 'never store plaintext', 'never concatenate strings') and replace with just the correct pattern to follow.

Dimension	Reasoning	Score
Conciseness	The skill is fairly comprehensive and most content earns its place, but some sections include explanations Claude already knows (e.g., 'never store plaintext passwords', 'never concatenate strings in SQL'). The BAD/GOOD pattern examples add value but some bullet points are somewhat obvious for Claude's knowledge level. The overall length (~200 lines) is reasonable for the breadth of topics covered.	2 / 3
Actionability	Nearly every section includes fully executable, copy-paste-ready Java code examples with proper imports and annotations. The examples cover JWT filters, authorization controllers, validated DTOs, parameterized queries, password encoding, CSRF config, CORS config, rate limiting, and security headers — all concrete and directly usable.	3 / 3
Workflow Clarity	The skill is organized as a reference/checklist rather than a multi-step workflow, which is appropriate for a security review guide. The 'Release Checklist' at the end provides a good validation checkpoint. However, there's no explicit sequence for how to conduct a security review (e.g., 'start here, then check this, validate that'), and no feedback loops for when issues are found during review.	2 / 3
Progressive Disclosure	The content is well-structured with clear section headers, but it's a monolithic file covering 12+ security topics with substantial code examples. Topics like rate limiting, CORS configuration, and dependency security could be split into separate reference files. No bundle files are provided, and no references to external files exist, though the breadth of content would benefit from such organization.	2 / 3
	Total	9 / 12 Passed

Description

47%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description effectively identifies its domain (Spring Security in Java Spring Boot) and lists relevant security topics with good trigger terms. However, it lacks concrete action verbs describing what the skill does and entirely omits a 'Use when...' clause, making it unclear when Claude should select this skill over others. Adding explicit trigger guidance and action-oriented language would significantly improve its effectiveness.

Suggestions

Add a 'Use when...' clause such as 'Use when the user asks about securing a Spring Boot application, configuring Spring Security, handling CSRF protection, or managing authentication/authorization in Java.'

Replace the passive 'best practices' framing with concrete actions, e.g., 'Configures Spring Security for authentication/authorization, implements CSRF protection, sets up rate limiting, audits dependency vulnerabilities, and hardens HTTP headers in Java Spring Boot services.'

Consider narrowing scope or grouping sub-topics to reduce potential overlap with general Java or web security skills.

Dimension	Reasoning	Score
Specificity	The description names the domain (Java Spring Boot / Spring Security) and lists several security areas (authentication/authorization, validation, CSRF, secrets, headers, rate limiting, dependency security), but these are topic areas rather than concrete actions. It doesn't specify what actions are performed (e.g., 'configure', 'audit', 'generate').	2 / 3
Completeness	The description answers 'what' (Spring Security best practices across several areas) but completely lacks a 'Use when...' clause or any explicit trigger guidance for when Claude should select this skill. Per the rubric, a missing 'Use when...' clause should cap completeness at 2, and since the 'what' is also somewhat vague (best practices rather than concrete actions), this scores a 1.	1 / 3
Trigger Term Quality	Contains strong natural trigger terms that users would actually say: 'Spring Security', 'Spring Boot', 'CSRF', 'rate limiting', 'authentication', 'authorization', 'validation', 'dependency security'. These cover a good range of terms a developer would use when seeking security guidance for Spring applications.	3 / 3
Distinctiveness Conflict Risk	The focus on Spring Security specifically is fairly distinctive, but the broad scope covering authentication, validation, headers, and dependencies could overlap with general security skills, Java coding skills, or web security skills. The Spring-specific framing helps but doesn't fully eliminate conflict risk.	2 / 3
	Total	8 / 12 Passed

Validation

90%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 10 / 11 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	10 / 11 Passed

Repository: affaan-m/ECC
Path: docs/zh-CN/skills/springboot-security/SKILL.md
Commit: 06c5e11

Reviewed: 1 day ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.