124-java-secure-coding

Use when you need to apply Java secure coding best practices — including validating untrusted inputs, defending against injection attacks with parameterized queries, minimizing attack surface via least privilege, applying strong cryptographic algorithms, handling exceptions securely without exposing sensitive data, managing secrets at runtime, avoiding unsafe deserialization, and encoding output to prevent XSS. This should trigger for requests such as Review Java code for secure coding; Find input validation risks in Java code; Review Java code for injection vulnerabilities; Improve secure error handling in Java services; Harden Java code against common security flaws. Part of Plinth Toolkit

Quality

81%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

71%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, lean body that points cleanly to a single reference for detail and includes explicit compile/verify validation checkpoints in its workflow. It could be more actionable by including one or two representative good/bad Java patterns inline and de-duplicating the Constraints section against the workflow.

Suggestions

Inline one or two representative good/bad Java patterns (e.g., a PreparedStatement example) so the body is actionable without opening the reference.

Merge or de-duplicate the Constraints bullets with the Workflow steps to remove the compile/verify repetition and improve conciseness.

Add a brief fix-and-retry loop after the compile/verify checkpoints rather than only 'stop immediately', to strengthen error recovery.

Dimension	Reasoning	Score
Conciseness	The overview is lean bullet points with no padding or basic-concept explanation, though the Constraints section partially restates the workflow steps (MANDATORY/SAFETY/VERIFY/BEFORE APPLYING) and could be tightened.	4 / 5
Actionability	Provides concrete commands and a specific reference path, but the actual secure-coding patterns (good/bad code) live entirely in the reference file, leaving the body's guidance on the core task at a high level.	3 / 5
Workflow Clarity	A clear 4-step sequence with explicit validation checkpoints (compile before, stop on failure, verify after); recovery is 'stop' rather than fix-and-retry, which is a minor gap.	4 / 5
Progressive Disclosure	SKILL.md is a concise overview with a single one-level-deep, clearly signaled reference file (references/124-java-secure-coding.md) that exists and holds the bulk detailed examples, giving easy navigation.	5 / 5
	Total	16 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, comprehensive description that uses third person voice, states concrete capabilities, and provides explicit trigger guidance with natural user phrases. Minor room to expand synonym coverage for trigger terms.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions (input validation, parameterized queries, least privilege, strong crypto, secure exceptions, secrets, deserialization, XSS encoding), giving comprehensive coverage of Java secure coding practices.	5 / 5
Completeness	Explicitly answers both what (the listed secure coding practices) and when ('Use when...' plus 'This should trigger for requests such as...') with concrete trigger phrases.	5 / 5
Trigger Term Quality	Includes natural user phrases like 'Review Java code for secure coding' and 'Find input validation risks', but a few common synonyms or phrasings are missing.	4 / 5
Distinctiveness Conflict Risk	Targets a clear Java secure-coding niche with distinct, language-specific triggers, giving minimal conflict risk with other skills.	5 / 5
	Total	19 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: jabrena/plinth
Path: skills/124-java-secure-coding/SKILL.md
Commit: 77b8825

Reviewed: about 23 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.