How to use the Spring Boot Security Review agent skill

What the skill makes the agent do

When the skill is installed, the agent applies security practices for Spring Boot services while it works. The skill covers authentication (JWT, OAuth2 and session-based), method-level authorization with @PreAuthorize, input validation with Bean Validation, SQL injection prevention, password hashing with BCrypt or Argon2, CSRF, CORS, security headers, secret handling, rate limiting and dependency CVE scanning.

The skill is guidance only. It does not run any tools itself, does not run scripts and does not use the network. The agent reads the checklist and examples in SKILL.md and uses them to shape the code it writes or reviews. The source file is written in Spanish, so the agent's explanations may follow the language of your request.

• Authentication: prefer stateless JWT or opaque tokens with a revocation list; use httpOnly, Secure, SameSite=Strict cookies for sessions.
• Authorization: enable @EnableMethodSecurity, deny by default, expose only the scopes required.
• Input: @Valid on controllers, constraints on DTOs, parameterized queries only.
• Passwords: use the PasswordEncoder bean, never plain text, never manual hashing.
• Secrets: no secrets in source code; load them from environment variables or a vault.

Install the skill from a ZIP file

Download the ZIP file from this page and unzip it. The package contains a single file, SKILL.md. Place the unzipped skill folder in one of two locations: your personal skills folder at ~/.claude/skills/, or a project-level folder at .claude/skills/ inside the project you are working on. A project folder makes the skill available only to that project.

If you use the Claude apps instead of the file system, you can upload the skill under Settings → Capabilities → Skills.

• Personal install: put the skill in ~/.claude/skills/.
• Project install: put the skill in .claude/skills/ inside your project.
• Claude apps: upload it under Settings → Capabilities → Skills.

Trigger the skill with natural requests

You do not need a special command. Describe the security-related work you want in plain language. The skill's activation list covers adding authentication, implementing authorization, validating user input, configuring CORS, CSRF or security headers, managing secrets, adding rate limiting or brute-force protection, and scanning dependencies for CVEs.

Name the file or endpoint and the kind of check you want. The more specific the request, the more useful the review. The skill guides the agent; it does not replace reading the agent's output.

• Review this UserController for security issues before I deploy it.
• Add a POST /api/users endpoint with validated input and BCrypt password hashing.
• Check application.yml for hardcoded credentials.
• Add rate limiting to the login endpoint.
• Explain how to restrict DELETE /api/admin/users to admins only.

Examples of what the agent produces

For a create-user endpoint, the skill's pattern is a validated DTO. Constraints such as @NotBlank, @Email, @Size and @Min go on the record fields, and the controller parameter is marked @Valid. The skill's 'bad' example shows a @RequestBody with no validation; the 'good' example shows the constrained version.

For access control, the skill shows @PreAuthorize("hasRole('ADMIN')") for role checks and @PreAuthorize("@authz.isOwner(#id, authentication)") for ownership checks. For secrets, the skill shows replacing a hardcoded datasource password with ${DB_PASSWORD}.

What you need before you start

The skill is for Java projects that use Spring Boot. The examples reference Spring Security, Bean Validation and Spring Data. If you want the rate limiting example, you need the Bucket4j library. If you want the Vault example, you need Spring Cloud Vault.

The skill does not apply to non-Java projects. Its examples would not transfer directly to other languages or frameworks.

• A Java project using Spring Boot.
• Spring Security, Bean Validation and Spring Data, as used in the examples.
• Bucket4j, only if you implement the rate limiting example.
• Spring Cloud Vault, only if you use the Vault integration example.

Safety notes and limits

The skill runs no scripts and makes no network requests, so installing it does not give the agent new tools. It only changes how the agent writes and reviews code.

It is not a security audit. The skill gives general patterns and a checklist. It does not test your actual code or configuration, so it can miss flaws specific to your project. Treat its output as a review aid and keep your normal testing and security processes in place.

• Runs scripts: no.
• Uses network: no.
• Does not test your code or configuration.
• Dependency scanning guidance refers to tools such as OWASP Dependency Check or Snyk in CI; the skill itself does not run them.