springboot-security

Spring Boot 服务的 Spring Security 身份验证/授权、验证、CSRF、密钥、响应头、速率限制和依赖项安全最佳实践。

Quality

73%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./docs/ja-JP/skills/springboot-security/SKILL.md

Quality

Content

80%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is concise and highly actionable with concrete, executable Spring Security examples. Its main weaknesses are the absence of an explicit review workflow with validation checkpoints and a monolithic structure that could split detail into reference files.

Suggestions

Add a short ordered "Review workflow" section (e.g. 1. inventory endpoints → 2. check auth/authz → 3. validate input/secrets → 4. run the release checklist) with explicit verification checkpoints.

Move per-domain deep-dive code examples (e.g. rate limiting, CORS, Vault integration) into reference files under ./references/ and link to them from SKILL.md to reduce inline bulk.

Add a validation/feedback step after the release checklist, e.g. re-run dependency scan and confirm headers via an actual response inspection before signing off.

Dimension	Reasoning	Score
Conciseness	Lean, action-oriented bullet lists paired with executable code; it assumes Claude's competence and avoids explaining concepts Claude already knows, with only minor bilingual annotation overhead.	3 / 3
Actionability	Provides fully executable Java/YAML snippets (JwtAuthFilter, @PreAuthorize controllers, BCryptPasswordEncoder, Bucket4j rate limiting) with BAD/GOOD contrasts that are copy-paste ready.	3 / 3
Workflow Clarity	Content is organized by security domain with a closing release checklist, but there is no explicit multi-step review sequence or validation/feedback loop for executing a security review.	2 / 3
Progressive Disclosure	Well-organized into clear sections, but it is a single ~270-line monolithic file with all detailed code inline and no bundle references to offload per-domain detail.	2 / 3
	Total	10 / 12 Passed

Description

67%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and clearly scoped to Spring Security, but reads as a capability list rather than a triggered instruction. Adding an explicit "Use when..." clause would raise completeness and trigger-term quality.

Suggestions

Add an explicit trigger clause, e.g. "Use when adding authentication, authorization, or security hardening to a Spring Boot service."

Reframe the capability list so it reads as actions a user would request (e.g. " Harden ...", "Configure CSRF and security headers") rather than a noun enumeration.

Include common user phrasings like "Spring Security", "JWT/OAuth2", and "secure my Spring Boot API" as natural trigger terms.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete capability areas — "身份验证/授权、校验、CSRF、机密管理、响应头、速率限制及依赖安全" — naming specific actions rather than vague language.	3 / 3
Completeness	It clearly states what the skill covers, but the "when" is missing — there is no explicit trigger clause; per the rubric, a missing "Use when..." caps completeness at 2.	2 / 3
Trigger Term Quality	Domain terms like authentication/authorization, CSRF, and rate limiting are present, but the description is a noun-list of capabilities with no natural "Use when..." trigger phrasing a user would say.	2 / 3
Distinctiveness Conflict Risk	Scoped narrowly to Spring Boot / Spring Security best practices, a clear niche unlikely to trigger for unrelated skills.	3 / 3
	Total	10 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: xu-xiang/everything-claude-code-zh
Path: docs/ja-JP/skills/springboot-security/SKILL.md
Commit: dfbf946

Reviewed: about 2 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.