304-frameworks-spring-boot-security

Use when you need to design, review, or improve security in Spring Boot applications — including SecurityFilterChain, OAuth2/JWT resource server patterns, form login basics, method security (@PreAuthorize), CSRF and CORS for APIs, session fixation, security headers, exception handling, password encoding, and sensitive-data-safe logging. This should trigger for requests such as Add Spring Boot security support; Review Spring Boot security configuration; Improve API authorization in Spring Boot; Add JWT resource server security in Spring Boot; Harden Spring Boot security headers and CSRF settings. Part of Plinth Toolkit

Quality

83%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

71%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured overview skill with strong progressive disclosure and a clear validated workflow, but its actionability is limited because the substantive security patterns live entirely in the reference rather than the body.

Suggestions

Include one or two short inline code snippets (e.g., a minimal SecurityFilterChain lambda or @PreAuthorize example) so the body is executable without requiring the reference for common cases.

Add an explicit fix-and-retry feedback loop after a failed compile/verify (e.g., 'If verification fails, fix the reported issues and re-run verify until it passes') to strengthen the recovery path.

Consolidate the 'What is covered' and 'When to use' lists to remove overlap and tighten the token budget.

Dimension	Reasoning	Score
Conciseness	The body is lean with no over-explanation of concepts Claude already knows, but the 'What is covered in this Skill?' list overlaps noticeably with the 'When to use this skill' list and the description, leaving minor trim-able redundancy.	4 / 5
Actionability	Concrete executable commands are present for the build steps (./mvnw compile, mvn clean verify), but the core security implementation guidance is deferred entirely to the reference file, so the body alone offers only incomplete executable guidance for the skill's actual purpose.	3 / 5
Workflow Clarity	A clear four-step sequence with explicit validation checkpoints (MANDATORY compile before, SAFETY stop on failure, VERIFY after) is provided; the recovery loop is 'stop immediately' rather than fix-and-retry, a minor validation gap.	4 / 5
Progressive Disclosure	The body is a clear overview that points to a single one-level-deep reference (references/304-frameworks-spring-boot-security.md, which exists), signaled in both the Workflow and a dedicated Reference section, making navigation easy.	5 / 5
	Total	16 / 20 Passed

Description

95%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, comprehensive description that clearly states capabilities and provides natural trigger phrases with low conflict risk. The only weakness is second-person voice ('you need to') which the rubric penalizes on specificity.

Dimension	Reasoning	Score
Specificity	Lists comprehensive concrete capabilities (SecurityFilterChain, OAuth2/JWT, @PreAuthorize, CSRF/CORS, session fixation, security headers, password encoding, sensitive-data logging) alongside the design/review/improve actions, but the second-person phrasing 'Use when you need to design...' triggers the rubric's voice penalty, reducing the score by one.	4 / 5
Completeness	Clearly answers both 'what' (design/review/improve Spring Boot security with a detailed capability list) and 'when' ('Use when you need to...' plus 'This should trigger for requests such as...') with concrete trigger phrases.	5 / 5
Trigger Term Quality	Natural trigger phrases a user would actually say are provided explicitly — 'Add Spring Boot security support', 'Review Spring Boot security configuration', 'Improve API authorization in Spring Boot', 'Add JWT resource server security', 'Harden Spring Boot security headers and CSRF settings' — covering synonyms and varied phrasings.	5 / 5
Distinctiveness Conflict Risk	Scoped to 'security in Spring Boot applications' with a clear niche and distinct Spring-Security-specific triggers, giving minimal conflict risk with other skills.	5 / 5
	Total	19 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: jabrena/plinth
Path: skills/304-frameworks-spring-boot-security/SKILL.md
Commit: 05bf9d1

Reviewed: 4 minutes ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.