springboot-security

Spring Security best practices for authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services.

Quality

76%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./.kiro/skills/springboot-security/SKILL.md

Quality

Content

82%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, highly actionable security reference with copy-paste-ready code across all major topics and a release checklist for validation. It is lean and well-organized, with only minor conciseness and workflow-sequencing gaps typical of a catalog-style skill.

Suggestions

Promote the "Checklist Before Release" earlier or frame the body as an explicit apply-then-verify workflow to strengthen sequencing for a review skill.

Trim redundant inline comments in code blocks (e.g., "// cost factor 12", "// BAD/GOOD" labels could be shortened) to tighten token efficiency.

Consider moving long code examples into a references/ file so SKILL.md stays a lean overview pointing one level deep to detail.

Dimension	Reasoning	Score
Conciseness	Mostly lean bullet-plus-code structure that assumes Claude's competence and avoids explaining basic Spring concepts, with only minor inline commentary that could be trimmed.	4 / 5
Actionability	Provides complete, copy-paste-ready Java examples (full filter classes, @PreAuthorize controllers, BCrypt beans, Bucket4j filter) covering the common security cases.	5 / 5
Workflow Clarity	A "Checklist Before Release" supplies explicit validation checkpoints, but the body is a reference catalog rather than a sequenced multi-step workflow, leaving minor sequence gaps.	4 / 5
Progressive Disclosure	Well-organized into clearly headed single-level sections with no nested references; no bundle files exist to split into, and the structure is navigable, though the catalog is monolithic in one file.	4 / 5
	Total	17 / 20 Passed

Description

70%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, well-scoped description that names many concrete security domains, but it omits explicit "Use when..." trigger guidance, which limits completeness. Jargon like "authn/authz" slightly weakens trigger-term naturalness.

Suggestions

Add a "Use when..." clause naming the triggering situations (e.g., "Use when adding authentication, configuring CSRF/security headers, or hardening Spring Boot endpoints").

Replace jargon "authn/authz" with the natural terms "authentication and authorization" that users actually say.

Lead with the strongest concrete action verbs (e.g., "Secure Spring Boot services with...") to lift specificity from naming domains to naming actions.

Dimension	Reasoning	Score
Specificity	Lists several concrete security domains ("authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security") but frames them as topics under "best practices for" rather than as concrete action verbs, leaving minor coverage gaps.	4 / 5
Completeness	The "what" is clear (Spring Security best practices across listed domains) but there is no "Use when..." clause or equivalent trigger guidance, which caps completeness at 3 per the rubric.	3 / 5
Trigger Term Quality	Strong natural terms like "Spring Security", "CSRF", "validation", "rate limiting", and "Java Spring Boot", but uses jargon "authn/authz" instead of the plain "authentication/authorization" users would typically say.	4 / 5
Distinctiveness Conflict Risk	Clearly scoped to "Spring Security" in "Java Spring Boot services", a distinct niche with minimal overlap risk against other skills.	5 / 5
	Total	16 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: affaan-m/ECC
Path: .kiro/skills/springboot-security/SKILL.md
Commit: d8409a4

Reviewed: 1 day ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.