Tessl • The package manager for agent skills

SkillPublic

304-frameworks-spring-boot-security

Use when you need to design, review, or improve security in Spring Boot applications — including SecurityFilterChain, OAuth2/JWT resource server patterns, form login basics, method security (@PreAuthorize), CSRF and CORS for APIs, session fixation, security headers, exception handling, password encoding, and sensitive-data-safe logging. This should trigger for requests such as Add Spring Boot security support; Review Spring Boot security configuration; Improve API authorization in Spring Boot; Add JWT resource server security in Spring Boot; Harden Spring Boot security headers and CSRF settings. Part of Plinth Toolkit

Quality

89%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

78%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, token-efficient overview that correctly pushes detailed security patterns into a single one-level-deep reference and includes real validation checkpoints (compile-before, stop-on-failure, verify-after) around a clear 4-step workflow. The main improvements are trimming the duplicated coverage/when-to-use lists and adding an error-recovery loop for post-change verification failure.

Suggestions

Merge the 'What is covered in this Skill?' bullet list into 'When to use this skill' (or drop it in favor of the frontmatter description) — the two sections plus the 'Scope' line largely repeat the same information.

Add a feedback loop for verification failure, e.g. 'If mvn verify fails, fix the failing checks and re-run verification before reporting' — currently only compile failure has an explicit stop condition.

Make workflow step 2 more actionable by naming what to inspect for project context (e.g. Spring Boot version, existing SecurityFilterChain beans, authentication setup) instead of the generic 'inspect the current project setup'.

Dimension	Reasoning	Score
Conciseness	The body is lean with no concept explanations Claude already knows, but there is redundancy: the 'What is covered in this Skill?' bullet list overlaps with 'When to use this skill' and with the frontmatter description, and the 'Scope' line ('Apply recommendations based on the reference rules and good/bad examples') restates what Constraints/Workflow already convey. Fits 'efficient; minor instances... that could be trimmed' rather than 'every token earns its place'.	4 / 5
Actionability	Concrete executable commands are present ('./mvnw compile or mvn compile', './mvnw clean verify or mvn clean verify', the exact reference path 'references/304-frameworks-spring-boot-security.md') and the reference exists with 8 worked examples. However workflow steps 2–3 ('Identify requested outcomes...', 'Implement or refactor... following the reference patterns') stay high-level, leaving minor gaps, which matches the level-4 anchor rather than fully copy-paste-ready level 5.	4 / 5
Workflow Clarity	A clear 4-step sequence (read reference and assess → gather scope → apply changes → verify and report) with explicit checkpoints: 'MANDATORY: Run ./mvnw compile... before applying any change', 'SAFETY: If compilation fails, stop immediately', 'VERIFY: Run ./mvnw clean verify... after'. Not level 5 because there is no feedback loop for what to do when post-change verification fails (no fix-and-retry cycle), which the level-5 anchor requires.	4 / 5
Progressive Disclosure	The body is a concise overview that delegates all detailed rules and examples to a single, well-signaled, one-level-deep reference: a dedicated '## Reference' section with a working link to references/304-frameworks-spring-boot-security.md (verified to exist, ~294 lines of structured guidance with no nested references), plus the path is repeated in workflow step 1 and Constraints. Clear overview, easy navigation, appropriate split.	5 / 5
	Total	17 / 20 Passed

Description

95%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description with a clear niche, comprehensive concrete capability coverage, and an explicit list of natural trigger phrases that mirror real user requests. The only flaw is the second-person 'Use when you need to' phrasing, which costs a specificity point under the third-person voice guideline; rewording to 'Use when designing, reviewing, or improving...' would fix it.

Suggestions

Rewrite the opening in third person to avoid the second-person penalty, e.g. 'Use when designing, reviewing, or improving security in Spring Boot applications' instead of 'Use when you need to design...'.

Consider adding common shorthand variations users might say, such as 'Spring Security' (the underlying framework name), to broaden natural keyword coverage.

Drop or shorten the trailing 'Part of Plinth Toolkit' clause if it adds no trigger value, keeping the description focused on capabilities and triggers.

Dimension	Reasoning	Score
Specificity	Lists many concrete capabilities — 'design, review, or improve security in Spring Boot applications', 'SecurityFilterChain', 'OAuth2/JWT resource server patterns', 'method security (@PreAuthorize)', 'CSRF and CORS for APIs', 'password encoding' — for comprehensive coverage matching the level-5 anchor, but the second-person phrasing 'Use when you need to' triggers the mandated 1-point reduction per judging guidelines.	4 / 5
Completeness	Explicitly answers both: what ('design, review, or improve security in Spring Boot applications — including SecurityFilterChain, OAuth2/JWT... sensitive-data-safe logging') and when ('Use when you need to...' plus 'This should trigger for requests such as...') with concrete trigger phrases, matching the level-5 anchor.	5 / 5
Trigger Term Quality	The explicit trigger list — 'Add Spring Boot security support; Review Spring Boot security configuration; Improve API authorization in Spring Boot; Add JWT resource server security in Spring Boot; Harden Spring Boot security headers and CSRF settings' — reads exactly like natural user requests, covering synonyms and phrasing variations users would actually say.	5 / 5
Distinctiveness Conflict Risk	Every capability and trigger phrase is anchored to the specific niche of Spring Boot security (SecurityFilterChain, @PreAuthorize, JWT resource server), so it is clearly distinguishable from generic security or other framework skills; 'Part of Plinth Toolkit' adds namespace context. Minimal conflict risk.	5 / 5
	Total	19 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: jabrena/plinth
Path: skills/304-frameworks-spring-boot-security/SKILL.md
Revision: 86b41dc

Reviewed: 10 hours ago

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.

304-frameworks-spring-boot-security

Table of Contents

Is this your skill?