How to use the Spring Boot Verification Loop agent skill

What the skill makes the agent do

The skill turns a pre-release check into a fixed sequence of phases. The agent runs the build, the static analysis tools, the test suite with coverage reporting, dependency and secret scans, and a review of your code changes. At the end it writes a short pass/fail report with a list of problems to fix.

The source also includes example test code (unit tests with mocked dependencies, Testcontainers integration tests and MockMvc controller tests) that the agent can follow when it writes tests.

• Build: a Maven or Gradle build that stops on failure
• Static analysis: SpotBugs, PMD and Checkstyle where configured
• Tests and coverage: test run plus JaCoCo report, with a target of 80% or more
• Security: OWASP dependency-check for known CVEs, plus grep-based secret and risky-pattern checks
• Diff review: git diff --stat and git diff against a short checklist
• Report: a PASS/FAIL summary with a numbered list of issues to fix

Check the requirements before you install

The skill runs commands in your project, so the tools they call must already be on your machine and configured in the project. The skill does not install Java, Maven, Gradle or Docker for you.

• Java and Maven or Gradle installed
• A Spring Boot project with the relevant plugins configured: spotbugs, pmd, checkstyle, jacoco and OWASP dependency-check, and optionally spotless and git-secrets
• Docker, only if you want to run the Testcontainers integration test example
• Git, for the diff review step
• Some steps are optional or depend on configured plugins; the agent should report a step as skipped rather than passed if its tool is missing

Install the skill from the ZIP

Download the ZIP for springboot-verification from this page. The skill is a single file named SKILL.md. Unzip the download so that the folder containing SKILL.md sits inside a skills directory.

You have two placement options. A user-wide install makes the skill available in all your projects. A project install keeps it with one repository and can be shared through version control.

You can also upload the skill in the Claude apps through Settings → Capabilities → Skills, if that option is available to your account.

• User-wide: unzip into ~/.claude/skills/
• Single project: unzip into .claude/skills/ inside the project root
• Claude apps: upload the skill under Settings → Capabilities → Skills

Ask for the check with a natural request

You do not need a special command. Describe what you want in plain language. The skill's activation conditions cover requests such as running the check before a pull request, after a large refactor or dependency upgrade, and before a deployment to staging or production.

Phrasings that should match the skill include the examples below. Mention the project and what you want back so the agent knows the scope.

• Run the Spring Boot verification loop on this service before I open a PR.
• Check this Spring Boot project before we deploy to staging and tell me if it is ready.
• I upgraded dependencies. Run the full build, lint, test and security checks.
• Make sure test coverage meets the 80% threshold and list anything that fails.

What the agent runs in each phase

The phases run in order. The source says that if the build fails, the agent should stop and fix it before continuing. Commands below are copied from the skill. The agent uses the Maven or Gradle variant that matches your project.

• Phase 1 Build: Maven or Gradle clean build with tests skipped
• Phase 2 Static analysis: SpotBugs, PMD and Checkstyle checks
• Phase 3 Tests and coverage: test run, then the JaCoCo report
• Phase 4 Security: OWASP dependency-check, secret searches and git-secrets if configured
• Phase 5 Lint/format: Spotless apply, only if the Spotless plugin is used
• Phase 6 Diff review: git diff --stat and git diff

Use the example tests as templates

The skill includes three example test styles. Ask the agent to follow one when you add a feature. Each example is written against Spring Boot test annotations and shows the assertion style the skill expects.

Unit tests isolate service logic with mocked dependencies using MockitoExtension. Integration tests use @SpringBootTest with @Testcontainers and a real PostgreSQL container instead of H2. API tests use @WebMvcTest with MockMvc to check status codes and JSON responses.

• Unit: @ExtendWith(MockitoExtension.class) with @Mock and @InjectMocks
• Integration: @SpringBootTest and @Testcontainers, requires Docker
• API: @WebMvcTest(UserController.class) with MockMvc, checking for 201 and 400 responses

Read the verification report

The skill ends with a fixed report template. Each line gives a PASS or FAIL status. The static, test and security lines name the tool or count that produced the result, so you can check the detail yourself.

The overall line is LISTO (ready) or NO LISTO (not ready). Treat the numbered list under Problemas a Corregir as the work to do before you open the pull request.

• Build, Estático, Pruebas, Seguridad, Diff and General lines
• Pruebas shows passed/total tests and the coverage percentage
• Seguridad shows the number of CVE findings
• General is LISTO or NO LISTO

Safety notes before you run it

The skill runs scripts and uses the network. The build commands execute your project code and plugins. The OWASP dependency-check step can download vulnerability data, and git-secrets scans git history. Run it on a development or feature branch, not against production systems.

Do not keep real credentials in the agent's context. The secret checks are simple grep patterns and will miss secrets written in other ways, so they are not a substitute for a human security review.

• Run on a local or feature branch, not on production infrastructure
• Keep real passwords, API keys and tokens out of the conversation and out of files the agent can read
• Expect the dependency scanner to need network access to fetch vulnerability data
• Review every flagged item yourself; the skill only catches known CVEs and simple patterns