304 Frameworks Spring Boot Security Agent Skill
Use when you need to design, review, or improve security in Spring Boot applications — including SecurityFilterChain, OAuth2/JWT resource server patterns, form login basics, method security (@PreAuthorize), CSRF and CORS for APIs, session fixation, security headers, exception handling, password encoding, and sensitive-data-safe logging. This should trigger for requests such as Add Spring Boot security support; Review Spring Boot security configuration; Improve API authorization in Spring Boot; Add JWT resource server security in Spring Boot; Harden Spring Boot security headers and CSRF settings. Part of Plinth Toolkit
Install
one command, takes just this skill from the repositorynpx skills add https://github.com/jabrena/plinth --skill 304-frameworks-spring-boot-securityThe instruction itself
5 sections, as written by the authorSpring Boot Security Guidelines
Apply Spring Boot security best practices with secure-by-default API boundaries.
What is covered in this Skill?
- Spring Security configuration and SecurityFilterChain setup
- Authentication and authorization policies for endpoints
- Method-level security (@PreAuthorize / @Secured)
- Principle of least privilege for roles and scopes
- Secure error handling and denial responses
- Sensitive data handling in logs and responses
Scope: Apply recommendations based on the reference rules and good/bad examples.
Constraints
Before applying security changes, ensure the project compiles. After improvements, run full verification.
- MANDATORY: Run
./mvnw compileormvn compilebefore applying any change - SAFETY: If compilation fails, stop immediately
- VERIFY: Run
./mvnw clean verifyormvn clean verifyafter applying improvements - BEFORE APPLYING: Read the reference for detailed rules and examples
When to use this skill
- Add Spring Boot security support
- Review Spring Boot security configuration
- Improve API authorization in Spring Boot
- Add JWT resource server security in Spring Boot
- Harden Spring Boot security headers and CSRF settings
- Implement method security with @PreAuthorize in Spring Boot
Workflow
- Read reference and assess project context
Read references/304-frameworks-spring-boot-security.md and inspect the current project setup before proposing changes.
- Gather scope and decide target improvements
Identify requested outcomes, constraints, and the minimum safe set of changes to apply.
- Apply framework-aligned changes
Implement or refactor security-related configuration/code following the reference patterns and project conventions.
- Run verification and report results
Execute appropriate build/tests and summarize what changed, what was verified, and any follow-up actions.
Reference
For detailed guidance, examples, and constraints, see references/304-frameworks-spring-boot-security.md.
Other skills for the same job
different authors, same section of the catalogue
You are a dependency security expert specializing in vulnerability scanning, license compliance, and supply chain security. Analyze project dependencies for known vulnerabilities, licensing issues, outdated packages, and provide actionable remediation strategies.
Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks.
Implement authentication and authorization with Better Auth - a framework-agnostic TypeScript authentication framework. Features include email/password authentication with verification, OAuth providers (Google, GitHub, Discord, etc.), two-factor authentication (TOTP, SMS), passkeys/WebAuthn support, session management, role-based access control (RBAC), rate limiting, and database adapters. Use when adding authentication to applications, implementing OAuth flows, setting up 2FA/MFA, managing user sessions, configuring authorization rules, or building secure authentication systems for web applications.
Package entire code repositories into single AI-friendly files using Repomix. Capabilities include pack codebases with customizable include/exclude patterns, generate multiple output formats (XML, Markdown, plain text), preserve file structure and context, optimize for AI consumption with token counting, filter by file types and directories, add custom headers and summaries. Use when packaging codebases for AI analysis, creating repository snapshots for LLM context, analyzing third-party libraries, preparing for security audits, generating documentation context, or evaluating unfamiliar codebases.
You are a dependency security expert specializing in vulnerability scanning, license compliance, and supply chain security. Analyze project dependencies for known vulnerabilities, licensing issues, outdated packages, and provide actionable remediation strategies.
Expert patterns for HubSpot CRM integration including OAuth authentication, CRM objects, associations, batch operations, webhooks, and custom objects. Covers Node.js and Python SDKs.
Perform language and framework specific security best-practice reviews and suggest improvements. Use when the user explicitly requests security best practices guidance, a security review or report, or secure-by-default coding help. Supports Python, JavaScript/TypeScript, and Go. Do NOT use for general code review, debugging, threat modeling (use security-threat-model), or non-security tasks.
Configures API gateways for routing, authentication, rate limiting, and request transformation in microservice architectures. Use when setting up Kong, Nginx, AWS API Gateway, or Traefik for centralized API management.
How to use it
Take jabrena/304-frameworks-spring-boot-security from the repository into ~/.claude/skills for personal
use, or into .claude/skills inside a project.
The agent identifies a skill by the name field in its header. Two skills with the
same name cannot sit side by side — one of them will be ignored.