New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Springboot Security

by xu-xiang in xu-xiang/everything-claude-code-zh

Spring Boot 服务的 Spring Security 身份验证/授权、验证、CSRF、密钥、响应头、速率限制和依赖项安全最佳实践。

MITAuto-check passedBackend & APIs

Install Springboot Security

skills CLI
$ npx skills add xu-xiang/everything-claude-code-zh --skill springboot-security -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install xu-xiang/everything-claude-code-zh springboot-security --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/xu-xiang/everything-claude-code-zh.git skills-src && mkdir -p .claude/skills && cp -r skills-src/docs/ja-JP/skills/springboot-security .claude/skills/springboot-security && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
springboot-security
GitHub stars
2k
Token cost
~703 tokens
SKILL.md length
127 words
Files
1
Skills in repo
78
Repo updated
First seen
Licence
MIT

At a glance

Spring Boot 服务的 Spring Security 身份验证/授权、验证、CSRF、密钥、响应头、速率限制和依赖项安全最佳实践。

  • Tasks that involve Web application vulnerabilities
  • SKILL.md covers 身份验证（Authentication）, 授权（Authorization）, 输入验证（Input Validation） and SQL 注入防护, plus 8 more sections
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
  • Tasks that involve Backend development

What it does

Springboot Security is an agent skill from xu-xiang/everything-claude-code-zh. Spring Boot 服务的 Spring Security 身份验证/授权、验证、CSRF、密钥、响应头、速率限制和依赖项安全最佳实践。

Its SKILL.md is about 700 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Backend & APIs, covering Web application vulnerabilities and Backend development. It works with Spring Boot. The repository describes itself as: everything-claude-code 中文翻译项目：完整的 Claude Code 配置集合（agents, skills, hooks, commands, rules, MCPs）。源自 Anthropic 黑客松获胜者的实战配置，助力中文工程师高效理解与使用 Claude Code。 The licence is MIT.

When your agent uses it

  • Tasks that involve Web application vulnerabilities
  • Tasks that involve Backend development

Example prompts

  • “/springboot-security”

What it can do on your machine

Read from SKILL.md and the folder at commit dfbf946. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md (its code samples are java).

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Springboot Security loads about 703 tokens when it runs. Until then it costs about 23 tokens; SKILL.md has 127 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~23
When it runs · the whole SKILL.md, loaded when a task matches
~703

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from xu-xiang/everything-claude-code-zh at commit dfbf946, republished under its MIT licence (© xu-xiang). 127 words, ~703 tokens.

Download SKILL.mdSave it as .claude/skills/springboot-security/SKILL.md (or your agent's skills folder).
name
springboot-security
description
Spring Boot 服务的 Spring Security 身份验证/授权、验证、CSRF、密钥、响应头、速率限制和依赖项安全最佳实践。

Spring Boot 安全审查

在添加身份验证、处理输入、创建端点或处理敏感密钥时使用。

身份验证（Authentication）

  • 优先使用无状态 JWT 或带有吊销列表的不透明令牌（Opaque Token）
  • 对于会话，使用 httpOnly、Secure、SameSite=Strict 的 Cookie
  • 在 OncePerRequestFilter 或资源服务器中验证令牌
java
@Component
public class JwtAuthFilter extends OncePerRequestFilter {
  private final JwtService jwtService;

  public JwtAuthFilter(JwtService jwtService) {
    this.jwtService = jwtService;
  }

  @Override
  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,
      FilterChain chain) throws ServletException, IOException {
    String header = request.getHeader(HttpHeaders.AUTHORIZATION);
    if (header != null && header.startsWith("Bearer ")) {
      String token = header.substring(7);
      Authentication auth = jwtService.authenticate(token);
      SecurityContextHolder.getContext().setAuthentication(auth);
    }
    chain.doFilter(request, response);
  }
}

授权（Authorization）

  • 启用方法级安全：@EnableMethodSecurity
  • 使用 @PreAuthorize("hasRole('ADMIN')") 或 @PreAuthorize("@authz.canEdit(#id)")
  • 默认拒绝访问，仅公开必要的范围（Scope）

输入验证（Input Validation）

  • 在控制器中使用 @Valid 进行 Bean Validation
  • 在 DTO 上应用约束：@NotBlank、@Email、@Size 以及自定义校验器
  • 在渲染前使用白名单对 HTML 进行清理（Sanitize）

SQL 注入防护

  • 使用 Spring Data Repository 或参数化查询
  • 原生查询使用 :param 绑定，禁止字符串拼接

CSRF 防护

  • 对于浏览器会话应用，启用 CSRF 并在表单/响应头中包含令牌
  • 对于使用 Bearer 令牌的纯 API 应用，禁用 CSRF 并依赖无状态身份验证
java
http
  .csrf(csrf -> csrf.disable())
  .sessionManagement(sm -> sm.sessionCreationPolicy(SessionCreationPolicy.STATELESS));

密钥管理（Secrets Management）

  • 禁止在源码中包含密钥。从环境变量或 Vault 加载
  • 确保 application.yml 中不含凭据，使用占位符代替
  • 定期轮换令牌和数据库凭证

安全响应头（Security Headers）

java
http
  .headers(headers -> headers
    .contentSecurityPolicy(csp -> csp
      .policyDirectives("default-src 'self'"))
    .frameOptions(HeadersConfigurer.FrameOptionsConfig::sameOrigin)
    .xssProtection(Customizer.withDefaults())
    .referrerPolicy(rp -> rp.policy(ReferrerPolicyHeaderWriter.ReferrerPolicy.NO_REFERRER)));

速率限制（Rate Limiting）

  • 对高成本端点应用 Bucket4j 或网关级限制
  • 记录突发流量日志并发送告警，返回带有重试提示的 429 状态码

依赖项安全（Dependency Security）

  • 在 CI 中运行 OWASP Dependency Check / Snyk
  • 保持 Spring Boot 和 Spring Security 处于受支持的版本
  • 针对已知的 CVE 漏洞使构建失败

日志与 PII（个人识别信息）

  • 禁止在日志中记录密钥、令牌、密码或完整的银行卡号（PAN）数据
  • 脱敏敏感字段，并使用结构化 JSON 日志

文件上传

  • 验证文件大小、内容类型（Content-Type）和扩展名
  • 存储在 Web 根目录之外，并根据需要进行扫描

发布前检查清单

  • 身份验证令牌已正确验证且未过期
  • 所有敏感路径都有授权保护（Authorization Guard）
  • 所有输入已验证并清理
  • 没有通过字符串拼接的 SQL 语句
  • 针对应用类型采用了正确的 CSRF 对策
  • 密钥已外部化，未提交至仓库
  • 已配置安全响应头
  • API 设有速率限制
  • 依赖项已扫描且为最新版本
  • 日志中不含敏感数据

注意：默认拒绝（Default Deny）、验证输入、应用最小权限原则，并优先采用“配置即安全”的实践。

© xu-xiang, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in docs/ja-JP/skills/springboot-security of xu-xiang/everything-claude-code-zh.

Open the folder on GitHubat commit dfbf946

Compare with similar skills

Springboot Security next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Springboot Security compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Springboot Security this skillxu-xiang/everything-claude-code-zh2k—~703Automated safety check: PassMIT
Springboot Securityaffaan-m/ECC275k3 repos~1.6kAutomated safety check: PassMIT
Springboot Securityaffaan-m/ECC275k—~2.1kAutomated safety check: PassMIT
Oryxos Initoryx-labs/oryxos186—~1.6kAutomated safety check: PassApache-2.0
Springboot Securityaffaan-m/ECC275k5 repos~2kAutomated safety check: PassMIT
Springboot Verificationaffaan-m/ECC275k5 repos~1.5kAutomated safety check: PassMIT

Similar skills

  • Springboot Security

    affaan-m/ECC

    Java Spring Boot 服务中认证/授权、验证、CSRF、密钥、标头、速率限制和依赖安全性的 Spring Security 最佳实践。

    275k GitHub starsUsed in 3 repos~1.6k tokens
    Backend & APIsAuto-check passed

  • Springboot Security

    affaan-m/ECC

    Buenas prácticas de Spring Security para autenticación/autorización, validación, CSRF, secretos, cabeceras, limitación de velocidad y seguridad de dependencias en servicios Java Spring Boot.

    275k GitHub stars~2.1k tokensUpdated 3 days ago
    Backend & APIsAuto-check passed

  • Oryxos Init

    oryx-labs/oryxos

    初始化 OryxOS（或同类 JDK 21 + Spring Boot 3.x 企业级单体）的工程地基：Maven 多模块骨架、 结构化日志、Actuator + Prometheus 监控、Spring MVC + 虚拟线程、springdoc OpenAPI、 统一响应体与全局异常/错误码、Google 格式 + 阿里编码规约（Spotless + 阿里 P3C +…

    186 GitHub stars~1.6k tokensUpdated today
    Backend & APIsAuto-check passed

  • Springboot Security

    affaan-m/ECC

    Spring Security best practices for authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services.

    275k GitHub starsUsed in 5 repos~2k tokens
    Backend & APIsAuto-check passed

  • Springboot Verification

    affaan-m/ECC

    Run the full Spring Boot verification loop — Maven or Gradle build, SpotBugs, PMD, and Checkstyle static analysis, unit and Testcontainers integration tests with JaCoCo coverage, OWASP dependency…

    275k GitHub starsUsed in 5 repos~1.5k tokens
    Testing & QAAuto-check passed

  • 304 Frameworks Spring Boot Security

    jabrena/plinth

    A skill your agent uses when you need to design, review, or improve security in Spring Boot applications — including SecurityFilterChain, OAuth2/JWT resource server patterns, form login basics…

    446 GitHub stars~719 tokensUpdated today
    Backend & APIsAuto-check passed

More from xu-xiang/everything-claude-code-zh

All 78 skills in this repo

  • Configure Ecc

    xu-xiang/everything-claude-code-zh

    Everything Claude Code 的交互式安装程序 — 引导用户选择并安装技能和规则到用户级或项目级目录，验证路径，并可选择优化已安装文件。

    2k GitHub starsUsed in 1 repo~2.1k tokens
    Auto-check passed

  • Continuous Learning V2

    xu-xiang/everything-claude-code-zh

    基于本能（Instinct）的学习系统，通过钩子（hooks）观察会话，创建带有置信度评分的原子本能，并将其演化为技能（Skills）、命令（Commands）或智能体（Agents）。v2.1 版本增加了项目作用域（project-scoped）的本能，以防止跨项目污染。

    2k GitHub stars~2.1k tokensUpdated 7 mo ago
    Auto-check passed

  • API Design

    xu-xiang/everything-claude-code-zh

    生产级 API 的 REST API 设计模式，包括资源命名、状态码、分页、过滤、错误响应、版本控制和速率限制. An agent skill from xu-xiang/everything-claude-code-zh.

    2k GitHub stars~2.7k tokensUpdated 7 mo ago
    Auto-check passed

  • Backend Patterns

    xu-xiang/everything-claude-code-zh

    后端架构模式、API 设计、数据库优化以及适用于 Node.js、Express 和 Next.js API 路由的服务端最佳实践。

    2k GitHub stars~3.2k tokensUpdated 7 mo ago
    Auto-check passed

  • Backend Patterns

    xu-xiang/everything-claude-code-zh

    后端架构模式、API 设计、数据库优化以及 Node.js、Express 和 Next.js API 路由的服务端最佳实践。

    2k GitHub stars~3.1k tokensUpdated 7 mo ago
    Auto-check passed

  • Backend Patterns

    xu-xiang/everything-claude-code-zh

    后端架构模式、API 设计、数据库优化以及针对 Node.js、Express 和 Next.js API 路由的服务端最佳实践。

    2k GitHub stars~3.2k tokensUpdated 7 mo ago
    Auto-check passed

Works with

Categories

Questions about Springboot Security

What does Springboot Security do?

Spring Boot 服务的 Spring Security 身份验证/授权、验证、CSRF、密钥、响应头、速率限制和依赖项安全最佳实践。. Springboot Security is an agent skill from xu-xiang/everything-claude-code-zh.

When should I use Springboot Security?

Springboot Security fits situations like: tasks that involve Web application vulnerabilities; tasks that involve Backend development.

How do I install Springboot Security in Claude Code?

Run `npx skills add xu-xiang/everything-claude-code-zh --skill springboot-security -a claude-code`. Or copy the skill folder (docs/ja-JP/skills/springboot-security in xu-xiang/everything-claude-code-zh) into .claude/skills/springboot-security in your project. Claude Code loads it when a task matches its description.

How do I install Springboot Security in Codex?

Run `npx skills add xu-xiang/everything-claude-code-zh --skill springboot-security -a codex`. Or copy the skill folder (docs/ja-JP/skills/springboot-security in xu-xiang/everything-claude-code-zh) into .agents/skills/springboot-security in your project. Codex loads it when a task matches its description.

Can I use Springboot Security in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add xu-xiang/everything-claude-code-zh --skill springboot-security -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/springboot-security, .gemini/skills/springboot-security, .github/skills/springboot-security and .opencode/skills/springboot-security in your project.

What does Springboot Security need to run?

SKILL.md names no scripts, command-line tools or credentials: Springboot Security is instructions for the agent only.

Does Springboot Security access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Springboot Security safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Springboot Security use?

Springboot Security is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Springboot Security use?

About 703 tokens (SKILL.md is roughly 2.8k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Springboot Security?

Skills that share tags, products or a category with Springboot Security: Springboot Security (affaan-m/ECC, 275k stars), Springboot Security (affaan-m/ECC, 275k stars), Oryxos Init (oryx-labs/oryxos, 186 stars) and Springboot Security (affaan-m/ECC, 275k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Springboot Security?

xu-xiang (a GitHub user) maintains it in xu-xiang/everything-claude-code-zh, which has 1,973 GitHub stars. The repository holds 78 skills in this directory. The repository was last updated on March 5, 2026.

Source: xu-xiang/everything-claude-code-zh on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.