Sast Xxe
utkusen/sast-skills
Detect XML External Entity (XXE) vulnerabilities in a codebase using a three-phase approach: recon (find XML parsing sites without external-entity hardening), batched verify (trace user input to…
Validate API consistency between two versions of Java libraries.
$ npx skills add ArabelaTso/Skills-4-SE --skill java-api-consistency-validator -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install ArabelaTso/Skills-4-SE java-api-consistency-validator --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/ArabelaTso/Skills-4-SE.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/java-api-consistency-validator .claude/skills/java-api-consistency-validator && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "java-api-consistency-validator" agent skill from https://github.com/ArabelaTso/Skills-4-SE/tree/main/skills/java-api-consistency-validator into .claude/skills/java-api-consistency-validator/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "java-api-consistency-validator", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/ArabelaTso/Skills-4-SE/tree/main/skills/java-api-consistency-validatorType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add ArabelaTso/Skills-4-SE --skill java-api-consistency-validator -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install ArabelaTso/Skills-4-SE java-api-consistency-validator --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/ArabelaTso/Skills-4-SE.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/java-api-consistency-validator .agents/skills/java-api-consistency-validator && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "java-api-consistency-validator" agent skill from https://github.com/ArabelaTso/Skills-4-SE/tree/main/skills/java-api-consistency-validator into .agents/skills/java-api-consistency-validator/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "java-api-consistency-validator", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add ArabelaTso/Skills-4-SE --skill java-api-consistency-validator -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install ArabelaTso/Skills-4-SE java-api-consistency-validator --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/ArabelaTso/Skills-4-SE.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/java-api-consistency-validator .cursor/skills/java-api-consistency-validator && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "java-api-consistency-validator" agent skill from https://github.com/ArabelaTso/Skills-4-SE/tree/main/skills/java-api-consistency-validator into .cursor/skills/java-api-consistency-validator/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "java-api-consistency-validator", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/ArabelaTso/Skills-4-SE.git --path skills/java-api-consistency-validator--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add ArabelaTso/Skills-4-SE --skill java-api-consistency-validator -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install ArabelaTso/Skills-4-SE java-api-consistency-validator --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/ArabelaTso/Skills-4-SE.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/java-api-consistency-validator .gemini/skills/java-api-consistency-validator && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "java-api-consistency-validator" agent skill from https://github.com/ArabelaTso/Skills-4-SE/tree/main/skills/java-api-consistency-validator into .gemini/skills/java-api-consistency-validator/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "java-api-consistency-validator", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install ArabelaTso/Skills-4-SE java-api-consistency-validatorInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add ArabelaTso/Skills-4-SE --skill java-api-consistency-validator -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/ArabelaTso/Skills-4-SE.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/java-api-consistency-validator .github/skills/java-api-consistency-validator && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "java-api-consistency-validator" agent skill from https://github.com/ArabelaTso/Skills-4-SE/tree/main/skills/java-api-consistency-validator into .github/skills/java-api-consistency-validator/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "java-api-consistency-validator", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add ArabelaTso/Skills-4-SE --skill java-api-consistency-validator -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install ArabelaTso/Skills-4-SE java-api-consistency-validator --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/ArabelaTso/Skills-4-SE.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/java-api-consistency-validator .opencode/skills/java-api-consistency-validator && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "java-api-consistency-validator" agent skill from https://github.com/ArabelaTso/Skills-4-SE/tree/main/skills/java-api-consistency-validator into .opencode/skills/java-api-consistency-validator/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "java-api-consistency-validator", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
java-api-consistency-validatorValidate API consistency between two versions of Java libraries.
Java API Consistency Validator is an agent skill from ArabelaTso/Skills-4-SE. Validate API consistency between two versions of Java libraries. Use when you need to compare API behavior, signatures, and exceptions between Java library versions to identify breaking changes, incompatible modifications, and behavior differences. The skill performs static analysis of Java code, compares method signatures, class definitions, interface changes, parameter types, return types, exception declarations, and generates a detailed JSON report with breaking changes, warnings, and migration guidance…
Its SKILL.md is about 660 tokens, which your agent loads only when the skill is triggered. The skill folder holds 2 other files, including scripts (for example `scripts/validate.py`).
It sits in Security, covering Static analysis and SAST. It works with Java. The repository describes itself as: A curated list of 180+ useful Claude Skills for Software Engineering and resources for customizing AI for SE workflows. The licence is Apache-2.0.
7 steps, taken from the first numbered list in SKILL.md.
Read from SKILL.md and the folder at commit 4f38503. It shows what the files ask for, not the result of running them.
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Ships 1 file in scripts/ (Python), which the agent can run.
Shell commands in SKILL.md call:
pythonFrom the folder's file list and the shell code blocks in SKILL.md.
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Java API Consistency Validator loads about 660 tokens when it runs. Until then it costs about 145 tokens; SKILL.md has 171 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.
The full file from ArabelaTso/Skills-4-SE at commit 4f38503, republished under its Apache-2.0 licence (© ArabelaTso). 171 words, ~660 tokens.
.claude/skills/java-api-consistency-validator/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.This skill validates API consistency between two versions of Java libraries by comparing signatures, behavior, and exceptions. It identifies breaking changes, incompatible modifications, and provides detailed reports to guide safe API migration or upgrade.
# Compare two versions of a Java library
python scripts/validate.py /path/to/old_version /path/to/new_version
# Specify output file
python scripts/validate.py old_lib/ new_lib/ --output report.jsonThe tool generates a JSON report with:
Example report:
{
"summary": {
"breaking_changes": 3,
"warnings": 5,
"info": 2
},
"breaking_changes": [
{
"type": "method_removed",
"class": "UserService",
"method": "getUser",
"severity": "breaking",
"message": "Method 'UserService.getUser' was removed"
}
]
}python scripts/validate.py <old_version_path> <new_version_path> [--output <report.json>]The validator exits with code 1 if breaking changes are found, 0 otherwise.
© ArabelaTso, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
SKILL.md and 1 other file (scripts) in skills/java-api-consistency-validator of ArabelaTso/Skills-4-SE.
Open the folder on GitHubat commit 4f38503
Java API Consistency Validator next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Java API Consistency Validator this skillArabelaTso/Skills-4-SE | 253 | — | ~660 | Automated safety check: Pass | Apache-2.0 | |
| Sast Xxeutkusen/sast-skills | 1.3k | — | ~7.2k | Automated safety check: Pass | MIT | |
| Nullawaynwjs/chromium.src | 160 | — | ~3k | Automated safety check: Pass | BSD-3-Clause | |
| CodeQL Security Scantrailofbits/skills | 7.4k | — | ~4.6k | Automated safety check: Notes | CC-BY-SA-4.0 | |
| Skylosduriantaco/skylos | 843 | — | ~581 | Automated safety check: Pass | Apache-2.0 | |
| Skylos Securityduriantaco/skylos | 843 | — | ~545 | Automated safety check: Pass | Apache-2.0 |
utkusen/sast-skills
Detect XML External Entity (XXE) vulnerabilities in a codebase using a three-phase approach: recon (find XML parsing sites without external-entity hardening), batched verify (trace user input to…
nwjs/chromium.src
Guide for resolving NullAway static analysis errors. An agent skill from nwjs/chromium.src.
trailofbits/skills
Scans a codebase for vulnerabilities with CodeQL's data flow and taint tracking in run-all or important-only modes, including data extensions for project-specific sources and sinks.
duriantaco/skylos
Run, interpret, or modify Skylos safely. An agent skill from duriantaco/skylos.
duriantaco/skylos
Investigate and harden Skylos security behavior. An agent skill from duriantaco/skylos.
trailofbits/skills
Compiles cryptographic code and inspects the assembly or bytecode for variable-time instructions, then triages which flagged operations actually touch secrets.
ArabelaTso/Skills-4-SE
Generate prioritized CVE watchlists and actionable security recommendations for repositories.
ArabelaTso/Skills-4-SE
Automatically migrate Python web applications between frameworks (Flask → FastAPI, Django → FastAPI).
ArabelaTso/Skills-4-SE
Generate test cases using metamorphic testing by applying transformations based on metamorphic properties.
ArabelaTso/Skills-4-SE
Instruments programs to capture execution traces specifically for reproducing reported bugs, enabling consistent replay and diagnosis of failures.
ArabelaTso/Skills-4-SE
Automatically migrate Spring MVC applications to Spring Boot.
ArabelaTso/Skills-4-SE
Instrument programs (Python, C/C++, Java) to capture snapshots of key program states at runtime, including variables, memory, and call stacks.
Works with
Categories
Validate API consistency between two versions of Java libraries. Java API Consistency Validator is an agent skill from ArabelaTso/Skills-4-SE. Validate API consistency between two versions of Java libraries.
Java API Consistency Validator fits situations like: you need to compare API behavior; exceptions between Java library versions to identify breaking changes; incompatible modifications; behavior differences.
Run `npx skills add ArabelaTso/Skills-4-SE --skill java-api-consistency-validator -a claude-code`. Or copy the skill folder (skills/java-api-consistency-validator in ArabelaTso/Skills-4-SE) into .claude/skills/java-api-consistency-validator in your project. Claude Code loads it when a task matches its description.
Run `npx skills add ArabelaTso/Skills-4-SE --skill java-api-consistency-validator -a codex`. Or copy the skill folder (skills/java-api-consistency-validator in ArabelaTso/Skills-4-SE) into .agents/skills/java-api-consistency-validator in your project. Codex loads it when a task matches its description.
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add ArabelaTso/Skills-4-SE --skill java-api-consistency-validator -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/java-api-consistency-validator, .gemini/skills/java-api-consistency-validator, .github/skills/java-api-consistency-validator and .opencode/skills/java-api-consistency-validator in your project.
Going by SKILL.md and its folder, Java API Consistency Validator needs Python for the scripts in its folder and the command-line tools its instructions call (python). Our summary lists: Python 3.
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.
Java API Consistency Validator is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
About 660 tokens (SKILL.md is roughly 2.6k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
Skills that share tags, products or a category with Java API Consistency Validator: Sast Xxe (utkusen/sast-skills, 1.3k stars), Nullaway (nwjs/chromium.src, 160 stars), CodeQL Security Scan (trailofbits/skills, 7.4k stars) and Skylos (duriantaco/skylos, 843 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
ArabelaTso (a GitHub user) maintains it in ArabelaTso/Skills-4-SE, which has 253 GitHub stars. The repository holds 150 skills in this directory. The repository was last updated on August 21, 2026.
Source: ArabelaTso/Skills-4-SE on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.