Use when you need to apply Java secure coding best practices — including validating untrusted inputs, defending against injection attacks with parameterized queries, minimizing attack surface via least privilege, applying strong cryptographic algorithms, handling exceptions securely without exposing sensitive data, managing secrets at runtime, avoiding unsafe deserialization, and encoding output to prevent XSS. This should trigger for requests such as Review Java code for secure coding; Find inp
SkillScore78Maintained
Automatic
◆Security & AppSec pack
Last verified 8/20/2026
What it changes
Passed 16 of 20 test cases with the skill, and 15 of 20 without it.
Without skill74%
With skill78%
Checks it passed that the model alone missed
Stops immediately upon compilation failure before applying code improvements.
Specifies executing ./mvnw clean verify as the post-modification verification step.
Specifies executing ./mvnw compile as the initial build step before applying changes.
3 fixed15 passed either way3 still failing2 broke
Pass-rate lift
+4 pp
Tokens
+0%
Agent turns
0%
Response time
-26%
Model gemini-3.6-flashMeasured 8/20/2026v118 of 23 cases passed with skill · 20 comparable
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 3
Prompt
Before making secure coding changes to a Maven-based Java microservice, what exact build step must be executed first to verify project state?
What was checked, without and with the skill
Checked
Without skill
With skill
Specifies executing ./mvnw compile as the initial build step before applying changes.
Missed
Passed
case-12 · gemini-3.6-flash · 8/20/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md55 lines2 files
Java Secure coding guidelines
Identify and apply Java secure coding practices to reduce vulnerabilities, protect sensitive data, and harden application behaviour against common attack vectors.
What is covered in this Skill?
Input validation: type, length, format, and range checks
SQL/OS/LDAP injection defence via PreparedStatement and parameterized APIs
Attack surface minimisation: least-privilege permissions, removal of unused features
Strong cryptography: BCrypt/Argon2 for passwords, AES-GCM for encryption, digital signatures; avoid deprecated ciphers (MD5, SHA-1, DES)
Secure exception handling: log diagnostic details internally, expose only generic messages to clients
Secrets management: load credentials from environment variables or secret managers — never hardcoded
Output encoding to prevent XSS in rendered content
Scope: The reference is organized by examples (good/bad code patterns) for each core area. Apply recommendations based on applicable examples.
Constraints
Before applying any secure coding changes, ensure the project compiles. If compilation fails, stop immediately — do not proceed until resolved. After applying improvements, run full verification.
MANDATORY: Run ./mvnw compile or mvn compile before applying any changes
SAFETY: If compilation fails, stop immediately — do not proceed until the project is in a valid state
VERIFY: Run ./mvnw clean verify or mvn clean verify after applying improvements
BEFORE APPLYING: Read the reference for detailed good/bad examples, constraints, and safeguards for each secure coding pattern
When to use this skill
Review Java code for secure coding
Find input validation risks in Java code
Review Java code for injection vulnerabilities
Improve secure error handling in Java services
Harden Java code against common security flaws
Workflow
Compile project before secure-coding changes
Run ./mvnw compile or mvn compile and stop immediately if compilation fails.
Use when you need to review, improve, or refactor Java code for generics quality — including avoiding raw types, applying the PECS (Producer Extends Consumer Super) principle for wildcards, using bounded type parameters, designing effective generic methods, leveraging the diamond operator, understanding type erasure implications, handling generic inheritance correctly, preventing heap pollution with @SafeVarargs, and integrating generics with modern Java features like Records, sealed types, and