springboot-security

Spring Security best practices for authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services. Use when reviewing Spring Security authn/authz, validation, CSRF, secrets, headers, or rate limiting.

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

90%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, lean security review skill with highly actionable, executable examples across all major Spring Security topics and a useful release checklist. Its main gap is the absence of an explicit end-to-end review workflow that sequences the sections with validation feedback loops.

Suggestions

Add a short ordered review workflow (e.g. authenticate -> authorize -> validate -> secrets -> headers -> rate-limit -> dependencies) with an explicit 're-check after fixing' loop to raise workflow clarity.

A few sections (Dependency Security, Logging and PII, File Uploads) are bullet-only; a one-line concrete command or config snippet each would keep actionability consistent throughout.

Consider splitting the per-topic code into a references/ file and keeping SKILL.md as an overview + checklist, which would let progressive disclosure reach the top anchor.

Dimension	Reasoning	Score
Conciseness	The body is lean: focused bullet directives and complete code examples with no padding or explanation of concepts Claude already knows (no 'what is CSRF/JWT' exposition). Every section earns its place.	5 / 5
Actionability	Provides copy-paste-ready, executable Java for every major topic (JwtAuthFilter, @PreAuthorize controllers, Bean Validation records, parameterized queries, PasswordEncoder bean, SecurityFilterChain configs, Bucket4j filter), covering the common review cases concretely.	5 / 5
Workflow Clarity	A review skill with a clear 'When to Activate' section and a 'Checklist Before Release' acting as validation checkpoints, but there is no explicit review sequence or validate/fix/retry loop tying the sections into an ordered workflow.	4 / 5
Progressive Disclosure	Well-organized into clearly headed sections with an overview ('When to Activate') up front and a closing checklist; no bundle files exist and all content is inline, but each section is short enough that nothing strongly needs to be split into separate reference files.	4 / 5
	Total	18 / 20 Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description with an explicit 'Use when' clause covering both capability and trigger context for a well-scoped Spring Security niche. Minor improvements would add common synonyms (JWT, OAuth2, CORS, SQL injection) and convert scope areas into concrete actions.

Suggestions

Add common trigger synonyms a user might say, e.g. JWT, OAuth2, CORS, and SQL injection, to broaden natural-term coverage.

Reframe the capability list as concrete actions (e.g. 'review JWT/OAuth2 authentication, enforce method-level authorization') rather than noun-area enumeration.

The body covers password encoding, SQL injection, and CORS which are absent from the description; surface one or two in the description for accurate scoping.

Dimension	Reasoning	Score
Specificity	Names the domain (Java Spring Boot services) and lists several concrete security areas — authn/authz, validation, CSRF, secrets, headers, rate limiting, dependency security — but frames them as scope areas ('best practices for ...') rather than concrete actions, leaving minor coverage gaps (e.g. password encoding, SQL injection, CORS appear only in the body).	4 / 5
Completeness	Explicitly answers both what ('Spring Security best practices for ... in Java Spring Boot services') and when ('Use when reviewing Spring Security authn/authz, validation, CSRF, secrets, headers, or rate limiting') with concrete trigger phrases.	5 / 5
Trigger Term Quality	Includes natural terms a reviewer would say ('Spring Security', 'authn/authz', 'CSRF', 'rate limiting', 'Spring Boot') in an explicit 'Use when reviewing ...' clause, but omits common synonyms users might also say (JWT, OAuth2, CORS, SQL injection).	4 / 5
Distinctiveness Conflict Risk	Spring Security for Java Spring Boot services is a clear niche with distinct, specific triggers and minimal overlap risk against other skills.	5 / 5
	Total	18 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: affaan-m/ECC
Path: skills/springboot-security/SKILL.md
Commit: d8409a4

Reviewed: 1 day ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.