Springboot Security
affaan-m/ECC
Spring Security best practices for authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services.
Java 源码认证与配置安全审计。当在 Java 白盒审计中需要检测认证绕过、权限缺陷或安全配置问题时触发. An agent skill from wgpsec/AboutSecurity.
Install Java Auth Config Audit
$ npx skills add wgpsec/AboutSecurity --skill java-auth-config-audit -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install wgpsec/AboutSecurity java-auth-config-audit --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/wgpsec/AboutSecurity.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/code-audit/java/java-auth-config-audit .claude/skills/java-auth-config-audit && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "java-auth-config-audit" agent skill from https://github.com/wgpsec/AboutSecurity/tree/master/skills/code-audit/java/java-auth-config-audit into .claude/skills/java-auth-config-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "java-auth-config-audit", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/wgpsec/AboutSecurity/tree/master/skills/code-audit/java/java-auth-config-auditType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add wgpsec/AboutSecurity --skill java-auth-config-audit -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install wgpsec/AboutSecurity java-auth-config-audit --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/wgpsec/AboutSecurity.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/code-audit/java/java-auth-config-audit .agents/skills/java-auth-config-audit && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "java-auth-config-audit" agent skill from https://github.com/wgpsec/AboutSecurity/tree/master/skills/code-audit/java/java-auth-config-audit into .agents/skills/java-auth-config-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "java-auth-config-audit", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add wgpsec/AboutSecurity --skill java-auth-config-audit -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install wgpsec/AboutSecurity java-auth-config-audit --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/wgpsec/AboutSecurity.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/code-audit/java/java-auth-config-audit .cursor/skills/java-auth-config-audit && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "java-auth-config-audit" agent skill from https://github.com/wgpsec/AboutSecurity/tree/master/skills/code-audit/java/java-auth-config-audit into .cursor/skills/java-auth-config-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "java-auth-config-audit", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/wgpsec/AboutSecurity.git --path skills/code-audit/java/java-auth-config-audit--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add wgpsec/AboutSecurity --skill java-auth-config-audit -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install wgpsec/AboutSecurity java-auth-config-audit --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/wgpsec/AboutSecurity.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/code-audit/java/java-auth-config-audit .gemini/skills/java-auth-config-audit && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "java-auth-config-audit" agent skill from https://github.com/wgpsec/AboutSecurity/tree/master/skills/code-audit/java/java-auth-config-audit into .gemini/skills/java-auth-config-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "java-auth-config-audit", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install wgpsec/AboutSecurity java-auth-config-auditInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add wgpsec/AboutSecurity --skill java-auth-config-audit -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/wgpsec/AboutSecurity.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/code-audit/java/java-auth-config-audit .github/skills/java-auth-config-audit && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "java-auth-config-audit" agent skill from https://github.com/wgpsec/AboutSecurity/tree/master/skills/code-audit/java/java-auth-config-audit into .github/skills/java-auth-config-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "java-auth-config-audit", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add wgpsec/AboutSecurity --skill java-auth-config-audit -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install wgpsec/AboutSecurity java-auth-config-audit --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/wgpsec/AboutSecurity.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/code-audit/java/java-auth-config-audit .opencode/skills/java-auth-config-audit && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "java-auth-config-audit" agent skill from https://github.com/wgpsec/AboutSecurity/tree/master/skills/code-audit/java/java-auth-config-audit into .opencode/skills/java-auth-config-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "java-auth-config-audit", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
java-auth-config-audit- GitHub stars
- 1.8k
- Token cost
- ~888 tokens
- SKILL.md length
- 256 words
- Files
- 2 (incl. references)
- Skills in repo
- 74
- Repo updated
- First seen
- Licence
- None found
At a glance
Java 源码认证与配置安全审计。当在 Java 白盒审计中需要检测认证绕过、权限缺陷或安全配置问题时触发. An agent skill from wgpsec/AboutSecurity.
- Works in 6 steps: 认证绕过审计要点 → 越权审计要点 → JWT 安全审计要点 → …
- Tasks that involve Authentication
- SKILL.md covers 相关 Skill, 深入参考, 6 类风险速查表 and 1. 认证绕过审计要点, plus 6 more sections
- Needs SECRET_KEY
What it does
Java Auth Config Audit is an agent skill from wgpsec/AboutSecurity. Java 源码认证与配置安全审计。当在 Java 白盒审计中需要检测认证绕过、权限缺陷或安全配置问题时触发。 覆盖 6 类风险: 认证绕过(Spring Security/Shiro Filter 链 URI 解析差异)、 越权(IDOR/水平越权/垂直越权)、JWT 安全(算法混淆/密钥泄露/Claims 验证)、 加密配置(弱算法/硬编码密钥/不安全随机数)、信息泄露(错误堆栈/Actuator/Debug 模式)、 业务逻辑漏洞(竞争条件/金额篡改/流程绕过)。
Its SKILL.md is about 890 tokens, which your agent loads only when the skill is triggered. The skill folder holds 2 other files, including reference files (for example `references/auth-config-patterns.md`).
It sits in Security, covering Authentication and Web application vulnerabilities. It works with Java. The repository describes itself as: Everything for pentest. | 渗透测试知识库，以 AI Agent 可执行的格式沉淀安全方法论。
When your agent uses it
- Tasks that involve Authentication
- Tasks that involve Web application vulnerabilities
Example prompts
- “/java-auth-config-audit”
Requirements
- A credential in SECRET_KEY
Workflow steps
6 steps, taken from the step headings in SKILL.md.
- 认证绕过审计要点
- 越权审计要点
- JWT 安全审计要点
- 加密配置审计要点
- 信息泄露审计要点
- 业务逻辑审计要点
What it can do on your machine
Read from SKILL.md and the folder at commit db4573f. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md.
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names these keys or tokens, usually read from environment variables:
SECRET_KEY
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Java Auth Config Audit loads about 888 tokens when it runs, and up to ~4.1k if it reads all its reference files. Until then it costs about 65 tokens; SKILL.md has 256 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
Without a licence we can't republish the file, so here is its outline and opening line. It has 256 words (~888 tokens).
“Java 后端项目中认证、授权与安全配置是最高频的漏洞产出面。本 skill 提供 6 大类白盒审计的完整检测思路，适用于 Spring Boot/Spring Security、Apache Shiro 及自定义框架。”
- name
- java-auth-config-audit
- metadata.tags
- authentication bypass, authorization, idor, jwt, shiro, spring security, 认证绕过, 越权, 加密配置, 信息泄露, actuator, 业务逻辑, java source audit
- metadata.category
- code-audit
Files
SKILL.md and 1 other file (references) in skills/code-audit/java/java-auth-config-audit of wgpsec/AboutSecurity.
- SKILL.md
- references/auth-config-patterns.md
Open the folder on GitHubat commit db4573f
Compare with similar skills
Java Auth Config Audit next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Java Auth Config Audit this skillwgpsec/AboutSecurity | 1.8k | — | ~888 | Automated safety check: Pass | None | |
| Springboot Securityaffaan-m/ECC | 274k | 5 repos | ~2k | Automated safety check: Pass | MIT | |
| Security Reviewjewbetcha/opentrace | 116 | 17 repos | ~3.1k | Automated safety check: Notes | MIT | |
| Mavenskjolber/3d-bin-container-packing | 568 | — | ~886 | Automated safety check: Pass | Apache-2.0 | |
| API Security Checklistrevfactory/harness-100 | 1.3k | — | ~1.7k | Automated safety check: Pass | Apache-2.0 | |
| Secure Code GuardianJeffallan/claude-skills | 12k | — | ~1.8k | Automated safety check: Pass | MIT |
Similar skills
Security Review
jewbetcha/opentrace
A skill your agent uses when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features.
Maven
skjolber/3d-bin-container-packing
Maven build expertise for this multi-module Java project. An agent skill from skjolber/3d-bin-container-packing.
API Security Checklist
revfactory/harness-100
Walks a backend-dev agent through OWASP API Top 10 checks, authentication and authorization patterns, and defense code during API design.
Secure Code Guardian
Jeffallan/claude-skills
Guides secure implementation of authentication, authorization, input validation and security headers, with password hashing, parameterized queries and OWASP Top 10 checks.
Exploiting Prototype Pollution In Javascript
mukul975/Anthropic-Cybersecurity-Skills
Detects and exploits JavaScript prototype pollution vulnerabilities in client-side and server-side (Node.js) applications to achieve XSS, RCE, or authentication bypass through property injection…
More from wgpsec/AboutSecurity
All 74 skills in this repoAboutsecurity Content Ingestion
wgpsec/AboutSecurity
A skill your agent uses whenever the user asks to add, absorb, migrate, port, update, merge, compare, or extract security knowledge into the AboutSecurity repository from any external resource such…
Ad Persistence
wgpsec/AboutSecurity
AD 域环境持久化技术。当已获取域管/本地管理员权限、需要建立持久访问以确保重启或密码更改后仍能回到目标环境时使用。覆盖主机级持久化（计划任务/注册表Run/COM劫持/WMI事件订阅/Windows服务/启动文件夹）、域级持久化（Golden Ticket/Silver Ticket/Skeleton…
Apt Emulation
wgpsec/AboutSecurity
APT 模拟与情报驱动红队方法论。基于已知 APT 组织的 TTP（MITRE ATT&CK）设计红队行动计划。当需要模拟特定威胁组织、设计高仿真攻击演练、或根据威胁情报制定攻击策略时使用
Argocd Tactics
wgpsec/AboutSecurity
ArgoCD 后渗透方法论：Redis缓存投毒集群接管、SSO认证绕过、未授权API枚举、恶意Application部署、Webhook SSRF、默认凭据利用。
C2 Beacon Analysis
wgpsec/AboutSecurity
C2 Beacon 配置提取与分析。当捕获到 Cobalt Strike/Sliver/Havoc 等 C2 框架的 Beacon 样本、内存 dump、或网络流量时使用。提取 C2 地址、通信协议、Malleable Profile、Watermark 等关键情报。红队视角：了解蓝队如何从 Beacon 提取 IOC 以改进 C2 OPSEC
C2 Evasion Methodology
wgpsec/AboutSecurity
C2框架免杀方法论：分析 C2 源码、搜索检测规则(YARA/Sigma/Snort)、逐规则分析、修改源码绕过检测。当遇到 YARA/Sigma/Snort 规则触发告警、beacon/implant 被杀软检测到时使用。第一步：确认 implant/beacon 语言和架构；第二步：搜索对应检测规则并逐规则分析修改
Related
Works with
Categories
Questions about Java Auth Config Audit
What does Java Auth Config Audit do?
Java 源码认证与配置安全审计。当在 Java 白盒审计中需要检测认证绕过、权限缺陷或安全配置问题时触发. An agent skill from wgpsec/AboutSecurity. Java Auth Config Audit is an agent skill from wgpsec/AboutSecurity.
When should I use Java Auth Config Audit?
Java Auth Config Audit fits situations like: tasks that involve Authentication; tasks that involve Web application vulnerabilities.
How do I install Java Auth Config Audit in Claude Code?
Run `npx skills add wgpsec/AboutSecurity --skill java-auth-config-audit -a claude-code`. Or copy the skill folder (skills/code-audit/java/java-auth-config-audit in wgpsec/AboutSecurity) into .claude/skills/java-auth-config-audit in your project. Claude Code loads it when a task matches its description.
How do I install Java Auth Config Audit in Codex?
Run `npx skills add wgpsec/AboutSecurity --skill java-auth-config-audit -a codex`. Or copy the skill folder (skills/code-audit/java/java-auth-config-audit in wgpsec/AboutSecurity) into .agents/skills/java-auth-config-audit in your project. Codex loads it when a task matches its description.
Can I use Java Auth Config Audit in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add wgpsec/AboutSecurity --skill java-auth-config-audit -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/java-auth-config-audit, .gemini/skills/java-auth-config-audit, .github/skills/java-auth-config-audit and .opencode/skills/java-auth-config-audit in your project.
What does Java Auth Config Audit need to run?
Going by SKILL.md and its folder, Java Auth Config Audit needs credentials named SECRET_KEY. Our summary lists: A credential in SECRET_KEY.
Does Java Auth Config Audit access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Java Auth Config Audit safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Java Auth Config Audit use?
No licence was found for Java Auth Config Audit or its repository. Without one, default copyright applies: ask the author before reusing or redistributing it.
How many tokens does Java Auth Config Audit use?
About 888 tokens (SKILL.md is roughly 3.6k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 3.2k tokens, read only when the agent opens those files.
What are the alternatives to Java Auth Config Audit?
Skills that share tags, products or a category with Java Auth Config Audit: Springboot Security (affaan-m/ECC, 274k stars), Security Review (jewbetcha/opentrace, 116 stars), Maven (skjolber/3d-bin-container-packing, 568 stars) and API Security Checklist (revfactory/harness-100, 1.3k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Java Auth Config Audit?
wgpsec (a GitHub organization) maintains it in wgpsec/AboutSecurity, which has 1,776 GitHub stars. The repository holds 74 skills in this directory. The repository was last updated on October 3, 2026.
Source: wgpsec/AboutSecurity on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.