Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →Use when you need to apply Java secure coding best practices — including validating untrusted inputs, defending against injection attacks with parameterized queries, minimizing attack surface via least privilege, applying strong cryptographic algorithms, handling exceptions securely without exposing sensitive data, managing secrets at runtime, avoiding unsafe deserialization, and encoding output to prevent XSS. This should trigger for requests such as Review Java code for secure coding; Find inp
.claude/skills/jabrena-124-java-secure-coding/SKILL.md| Test case | Without → With | Effect | Δ tokens | Δ turns |
|---|---|---|---|---|
| case-11 | ✗→✓ | ▲ Improved | -41% | 0% |
| case-12 | ✗→✓ | ▲ Improved | -14% | 0% |
| case-13 | ✗→✓ | ▲ Improved | -29% | 0% |
| case-07 | ✓→✗ | ▼ Worse | -74% | 0% |
| case-18 | ✓→✗ | ▼ Worse | 4% | 0% |
Identify and apply Java secure coding practices to reduce vulnerabilities, protect sensitive data, and harden application behaviour against common attack vectors.
What is covered in this Skill?
PreparedStatement and parameterized APIsScope: The reference is organized by examples (good/bad code patterns) for each core area. Apply recommendations based on applicable examples.
Before applying any secure coding changes, ensure the project compiles. If compilation fails, stop immediately — do not proceed until resolved. After applying improvements, run full verification.
./mvnw compile or mvn compile before applying any changes./mvnw clean verify or mvn clean verify after applying improvementsRun ./mvnw compile or mvn compile and stop immediately if compilation fails.
Read references/124-java-secure-coding.md and identify applicable vulnerabilities and hardening opportunities.
Implement selected protections for input validation, crypto, secrets, deserialization, and output encoding.
Run ./mvnw clean verify or mvn clean verify after applying improvements.
For detailed guidance, examples, and constraints, see references/124-java-secure-coding.md.
| Case | Status | Duration (ms) | Turns | Tokens | Tool calls | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Without | With | Δ | Without | With | Δ | Without | With | Δ | Without | With | Δ | ||
case-01 | fail→fail | 15,708 | 16,921 | +8% | 1 | 1 | 0% | 3,900 | 853 | -78% | 0 | 0 | — |
case-16 | pass→pass | 14,786 | 12,673 | -14% | 1 | 1 | 0% | 2,177 | 2,539 | +17% | 0 | 0 | — |
case-02 | fail→fail | 14,671 | 25,993 | +77% | 1 | 1 | 0% | 2,872 | 845 | -71% | 0 | 0 | — |
case-03 | fail→fail | 17,748 | 24,361 | +37% | 1 | 1 | 0% | 2,516 | 4,171 | +66% | 0 | 0 | — |
case-04 | pass→pass | 13,001 | 8,363 | -36% | 1 | 1 | 0% | 2,115 | 2,069 | -2% | 0 | 0 | — |
case-05 | pass→pass | 15,297 | 8,078 | -47% | 1 | 1 | 0% | 2,718 | 2,044 | -25% | 0 | 0 | — |
case-06 | pass→pass | 10,664 | 9,068 | -15% | 1 | 1 | 0% | 1,898 | 2,016 | +6% | 0 | 0 | — |
case-07 | pass→fail | 25,862 | 6,610 | -74% | 1 | 1 | 0% | 2,896 | 758 | -74% | 0 | 0 | — |
case-08 | pass→pass | 14,252 | 9,741 | -32% | 1 | 1 | 0% | 2,334 | 2,153 | -8% | 0 | 0 | — |
case-09 | pass→pass | 15,669 | 9,169 | -41% | 1 | 1 | 0% | 2,675 | 2,169 | -19% | 0 | 0 | — |
case-10 | pass→pass | 10,718 | 8,838 | -18% | 1 | 1 | 0% | 2,067 | 1,974 | -4% | 0 | 0 | — |
case-21 | pass→pass | 10,229 | 7,929 | -22% | 1 | 1 | 0% | 1,803 | 1,987 | +10% | 0 | 0 | — |
case-11 | fail→pass | 19,634 | 5,756 | -71% | 1 | 1 | 0% | 2,839 | 1,688 | -41% | 0 | 0 | — |
case-12 | fail→pass | 7,634 | 2,079 | -73% | 1 | 1 | 0% | 1,029 | 881 | -14% | 0 | 0 | — |
case-13 | fail→pass | 6,948 | 2,942 | -58% | 1 | 1 | 0% | 1,210 | 865 | -29% | 0 | 0 | — |
case-14 | pass→pass | 13,468 | 12,506 | -7% | 1 | 1 | 0% | 2,483 | 3,094 | +25% | 0 | 0 | — |
case-15 | pass→pass | 12,495 | 11,131 | -11% | 1 | 1 | 0% | 2,210 | 2,527 | +14% | 0 | 0 | — |
case-17 | pass→pass | 10,238 | 6,564 | -36% | 1 | 1 | 0% | 1,687 | 1,674 | -1% | 0 | 0 | — |
case-18 | pass→fail | 12,634 | 10,664 | -16% | 1 | 1 | 0% | 2,287 | 2,381 | +4% | 0 | 0 | — |
case-19 | pass→pass | 14,358 | 14,404 | +0% | 1 | 1 | 0% | 2,461 | 2,974 | +21% | 0 | 0 | — |
case-20 | pass→pass | 14,761 | 8,586 | -42% | 1 | 1 | 0% | 2,483 | 2,043 | -18% | 0 | 0 | — |
case-22 | pass→pass | 16,909 | 13,271 | -22% | 1 | 1 | 0% | 2,927 | 2,943 | +1% | 0 | 0 | — |
case-23 | pass→pass | 13,557 | 9,279 | -32% | 1 | 1 | 0% | 2,591 | 2,342 | -10% | 0 | 0 | — |
DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted, and 20 counted toward the lift figure. The other 3 produced results that are not comparable between the two arms, so they are excluded from the headline rather than averaged into it. The headline lift of +4 percentage points is the difference between those two pass rates over the 20 comparable cases. 2 cases got worse with the skill loaded, and they are included in that figure.
Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.
Other measured skills in the registry, with their headline benchmark lift.