CtrlK
BlogDocsLog inGet started
Tessl Logo

springboot-security

Spring Security best practices for authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services.

68

1.29x
Quality

52%

Does it follow best practices?

Impact

96%

1.29x

Average score across 3 eval scenarios

SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./docs/ja-JP/skills/springboot-security/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

50%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

This is a solid reference-style security checklist for Spring Boot with good section organization and some useful executable code examples. Its main weaknesses are inconsistent actionability across sections (some have code, many don't) and inclusion of guidance that Claude would already know (basic security principles). The release checklist is a strong addition but the skill would benefit from more concrete code examples in the weaker sections.

Suggestions

Add executable code examples for input validation (e.g., a DTO with @Valid annotations and a controller method) and SQL injection prevention (e.g., a Spring Data repository with @Query parameterized binding) to match the quality of the JWT and headers sections.

Remove or condense obvious guidance Claude already knows, such as 'don't put secrets in source code' and 'validate file size and content type' — instead provide the specific Spring Boot configuration or code to accomplish these.

Consider adding a brief workflow sequence for conducting a security review (e.g., 1. Check auth config → 2. Audit endpoints → 3. Run dependency scan → 4. Verify with checklist) to give clearer procedural guidance.

DimensionReasoningScore

Conciseness

Generally efficient with bullet points and code examples, but some sections like secrets management and file uploads state things Claude already knows (e.g., 'don't put secrets in source code'). The Japanese text adds some overhead but the content is mostly lean.

2 / 3

Actionability

Provides some executable code examples (JWT filter, CSRF config, security headers), but many sections are bullet-point guidance without concrete code (rate limiting, input validation, SQL injection prevention). The mix of actionable code and vague directives like 'validate size, content type, extension' lands it at a 2.

2 / 3

Workflow Clarity

The release checklist at the end provides a useful validation checkpoint, and sections are logically organized by security concern. However, there's no explicit multi-step workflow with sequencing or feedback loops for the review process itself — it reads more as a reference list than a guided workflow.

2 / 3

Progressive Disclosure

Content is well-organized into clear sections with headers, but everything is in a single monolithic file with no references to external files for deeper topics. Some sections (like rate limiting or dependency security) could benefit from separate detailed guides, but given no bundle files exist, the inline approach is acceptable though not ideal.

2 / 3

Total

8

/

12

Passed

Description

54%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description effectively identifies its niche domain (Spring Security for Java Spring Boot) and includes strong trigger terms that developers would naturally use. However, it reads more like a topic list than an actionable skill description—it lacks concrete actions (what it does) and completely omits explicit trigger guidance (when to use it). Adding a 'Use when...' clause and converting topic areas into specific actions would significantly improve it.

Suggestions

Add an explicit 'Use when...' clause, e.g., 'Use when the user asks about securing a Spring Boot application, configuring authentication/authorization, or reviewing security configurations.'

Convert topic categories into concrete actions, e.g., 'Reviews and configures authentication/authorization flows, implements CSRF protection, manages secrets securely, sets security headers, and audits dependency vulnerabilities.'

Consider adding file type or context triggers, e.g., 'when working with SecurityConfig.java, WebSecurityConfigurerAdapter, or Spring Security filter chains.'

DimensionReasoningScore

Specificity

The description names the domain (Spring Security) and lists several topic areas (authn/authz, validation, CSRF, secrets, headers, rate limiting, dependency security), but these are categories rather than concrete actions. It says 'best practices' but doesn't specify what actions it performs (e.g., 'configures CSRF protection', 'reviews authentication flows').

2 / 3

Completeness

The description answers 'what' at a high level (best practices for various security topics) but completely lacks a 'Use when...' clause or any explicit trigger guidance for when Claude should select this skill. Per the rubric, a missing 'Use when...' clause caps completeness at 2, and the 'what' is also somewhat weak (topics listed, not actions), so this scores a 1.

1 / 3

Trigger Term Quality

Includes strong natural keywords users would say: 'Spring Security', 'authn/authz', 'CSRF', 'rate limiting', 'secrets', 'headers', 'Java Spring Boot', 'dependency security', 'validation'. These cover a good range of terms a developer would naturally use when seeking security guidance.

3 / 3

Distinctiveness Conflict Risk

The description is clearly scoped to Spring Security in Java Spring Boot services, which is a distinct niche. The combination of specific security topics (CSRF, authn/authz, rate limiting) with the Spring Boot framework makes it unlikely to conflict with other skills.

3 / 3

Total

9

/

12

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation11 / 11 Passed

Validation for skill structure

No warnings or errors.

Repository
affaan-m/everything-claude-code
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.