Java Springboot Skill Security Audit
What the author says it does (original text)
Get best practices for developing applications with Spring Boot.
No obvious risks found in this check
- Files checked
- 1
- Risks found
- 0
Inside this skill
This Skill is a Spring Boot development guide intended to help generate application code that follows established best practices; the provided material contains no scripts, installation commands, or network operations.
View source
---name: java-springbootdescription: 'Get best practices for developing applications with Spring Boot.'---# Spring Boot Best PracticesYour goal is to help me write high-quality Spring Boot applications by following established best practices.The configuration guidance explicitly says not to hardcode secrets and recommends environment variables or a dedicated secrets manager. Credentials or network access would arise only if a user separately adopts those external services; the Skill itself does not instruct the agent to read or transmit secrets.
View source
- **Externalized Configuration:** Use `application.yml` (or `application.properties`) for configuration. YAML is often preferred for its readability and hierarchical structure.- **Type-Safe Properties:** Use `@ConfigurationProperties` to bind configuration to strongly-typed Java objects.- **Profiles:** Use Spring Profiles (`application-dev.yml`, `application-prod.yml`) to manage environment-specific configurations.- **Secrets Management:** Do not hardcode secrets. Use environment variables, or a dedicated secret management tool like HashiCorp Vault or AWS Secrets Manager.Its security guidance recommends Spring Security, strong password hashing, parameterized database access, and output encoding to reduce injection and XSS risks.
View source
## Security- **Spring Security:** Use Spring Security for authentication and authorization.- **Password Encoding:** Always encode passwords using a strong hashing algorithm like BCrypt.- **Input Sanitization:** Prevent SQL injection by using Spring Data JPA or parameterized queries. Prevent Cross-Site Scripting (XSS) by properly encoding output.The testing guidance may lead an agent to suggest loading a Spring application context or using container-based dependencies in a concrete project, but these are recommendations only; there are no commands to execute, privileges to elevate, or instructions to modify the environment automatically.
View source
## Testing- **Unit Tests:** Write unit tests for services and components using JUnit 5 and a mocking framework like Mockito.- **Integration Tests:** Use `@SpringBootTest` for integration tests that load the Spring application context.- **Test Slices:** Use test slice annotations like `@WebMvcTest` (for controllers) or `@DataJpaTest` (for repositories) to test specific parts of the application in isolation.- **Testcontainers:** Consider using Testcontainers for reliable integration tests with real databases, message brokers, etc.Files and check records1 files
Coverage and gaps
Content covered in each file
These are the source ranges included in this check, not a guarantee that every issue has been resolved.
SKILL.mdFull text included
This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.
SKILL.mdInstructions
- Lines read
- 66
- File checksum (to compare versions)
- cb0694be43208ad0422143b030f3e4f1f54cd2883883650ba78736b543dd8dee