springboot-security

Java Spring Boot 服务中认证/授权、验证、CSRF、密钥、标头、速率限制和依赖安全性的 Spring Security 最佳实践。

1.08x

Quality

74%

Does it follow best practices?

Impact

100%

1.08x

Average score across 6 eval scenarios

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./docs/zh-CN/skills/springboot-security/SKILL.md

Quality

Content

78%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with comprehensive, executable Spring Security examples and a useful pre-release checklist, though it is somewhat verbose as a single monolithic file. Splitting detailed per-topic examples into reference files would improve progressive disclosure and token efficiency.

Suggestions

Move detailed per-topic code examples (e.g., the full JwtAuthFilter and RateLimitFilter classes) into reference files under references/, keeping SKILL.md as a concise overview with signaled links.

Tighten or shorten the longer class examples in the main body to reduce token load on every invocation.

Add explicit validation/verification phrasing around the checklist items to strengthen the workflow-clarity feedback loop.

Dimension	Reasoning	Score
Conciseness	The body is mostly lean bullet lists and executable code with little over-explanation of concepts Claude already knows; a few longer class examples (JwtAuthFilter, RateLimitFilter) could be trimmed slightly.	4 / 5
Actionability	Every topic is backed by copy-paste-ready, executable code (JwtAuthFilter, @PreAuthorize controller, validated DTO record, parameterized queries, BCryptPasswordEncoder, CORS bean, Bucket4j filter), covering the common Spring Security cases concretely.	5 / 5
Workflow Clarity	Content is organized into clear topical sections with a '何时激活' trigger list and a final pre-release checklist that acts as a validation checkpoint; no destructive/batch workflow requires feedback loops, so the minor sequencing gaps keep it just below 5.	4 / 5
Progressive Disclosure	Sections are well-labeled and navigable, but all ~272 lines live inline in a single file with no bundle references; several per-topic code examples could be offloaded to reference files to keep the overview lean (the under-50-line exception does not apply).	3 / 5
	Total	16 / 20 Passed

Description

70%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and well-targeted to a distinct Spring Boot security niche, but it omits any explicit 'Use when...' trigger guidance, which caps its completeness. Adding a trigger clause and a few more natural synonyms (JWT, OAuth2, CORS) would raise the remaining dimensions.

Suggestions

Add an explicit 'Use when...' clause listing trigger situations (e.g., 'Use when adding authentication, configuring CSRF, or hardening Spring Boot endpoints').

Include common synonyms and file/protocol terms users say naturally, such as JWT, OAuth2, CORS, and OWASP, alongside the existing keywords.

Reframe the capability areas as concrete actions where possible (e.g., 'configure CSRF', 'encode passwords with BCrypt') rather than only naming topics under 'best practices'.

Dimension	Reasoning	Score
Specificity	Names the Spring Security domain and lists seven concrete capability areas (认证/授权、验证、CSRF、密钥、标头、速率限制、依赖安全性), but frames them as topics under a generic 'best practices' verb rather than distinct concrete actions, leaving minor coverage gaps.	4 / 5
Completeness	Clearly states what the skill covers (Spring Security best practices across seven security areas) but provides no 'Use when...' trigger clause, so completeness is capped at 3 per the missing-trigger guideline.	3 / 5
Trigger Term Quality	Includes natural technical terms a Spring Boot developer would say ('Spring Security', '认证/授权', 'CSRF', '速率限制'), but omits common synonyms and variations like JWT, OAuth2, CORS, or OWASP.	4 / 5
Distinctiveness Conflict Risk	Targets a clear niche (Java Spring Boot / Spring Security) with a distinctive combination of specific security topics, giving it minimal overlap or conflict risk with other skills.	5 / 5
	Total	16 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: affaan-m/ECC
Path: docs/zh-CN/skills/springboot-security/SKILL.md
Commit: e04ea0b

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.