Use when you need to design, review, or improve security in Micronaut applications — including micronaut-security authentication, @Secured and intercept-url-map rules, JWT/session strategies, SecurityService checks, CORS, CSRF awareness for browser apps, rejection handlers, and sensitive-data-safe logging. This should trigger for requests such as Add Micronaut security support; Review Micronaut security configuration; Improve API authorization in Micronaut; Add JWT security in Micronaut; Harden
SkillScore82Maintained
Automatic
◆Security & AppSec pack
Last verified 8/20/2026
What it changes
Passed 16 of 19 test cases with the skill, and 10 of 19 without it.
Without skill55%
With skill82%
Checks it passed that the model alone missed
Executes maven compile prior to making edits.
Executes maven clean verify to validate updates.
Specifies executing maven clean verify for verification.
and 3 more in the full report
6 fixed12 passed either way4 still failing0 broke
Pass-rate lift
+27 pp
Tokens
-23%
Agent turns
0%
Response time
-45%
Model gemini-3.6-flashMeasured 8/20/2026v118 of 22 cases passed with skill · 19 comparable
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 6 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 6
Prompt
We are implementing role-based access control for a Micronaut payment service controller. What command should be run first to confirm the project is in a clean, compilable state before making edits?
What was checked, without and with the skill
Checked
Without skill
With skill
Executes maven compile prior to making edits.
Missed
Passed
case-19 · gemini-3.6-flash · 8/20/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md54 lines2 files
Micronaut Security Guidelines
Apply Micronaut security best practices with secure-by-default API boundaries.
What is covered in this Skill?
Micronaut security configuration and authentication setup
Authorization with @Secured and role-based policies
Endpoint and route protection strategy
Least-privilege design and policy boundaries
Secure error/denial behavior
Sensitive data handling in logs and responses
Scope: Apply recommendations based on the reference rules and good/bad examples.
Constraints
Before applying security changes, ensure the project compiles. After improvements, run full verification.
MANDATORY: Run ./mvnw compile or mvn compile before applying any change
SAFETY: If compilation fails, stop immediately
VERIFY: Run ./mvnw clean verify or mvn clean verify after applying improvements
BEFORE APPLYING: Read the reference for detailed rules and examples
When to use this skill
Add Micronaut security support
Review Micronaut security configuration
Improve API authorization in Micronaut
Add JWT security in Micronaut
Harden Micronaut route authorization rules
Implement @Secured policies in Micronaut controllers
Workflow
Read reference and assess project context
Read references/504-frameworks-micronaut-security.md and inspect the current project setup before proposing changes.
Use when you need Kafka messaging in Micronaut — including @KafkaClient and @KafkaListener design, @Serdeable serialization, topic/partition strategy, TestPropertyProvider integration tests, retries and dead-letter processing, and error handling. This should trigger for requests such as Add Kafka in Micronaut; Review Micronaut Kafka listeners; Improve retry and failure handling for Micronaut Kafka; Configure Micronaut Kafka clients listeners or SerDes; Add Micronaut Kafka retry or dead-letter ha