java-architect

An agent skill by Jeffallan, from Jeffallan/claude-skills. Tags: api, debugging, java, performance, security, web.

What it does

Use when building, configuring, or debugging enterprise Java applications with Spring Boot 3.x, microservices, or reactive programming. Invoke to implement WebFlux endpoints, optimize JPA queries and database performance, configure Spring Security with OAuth2/JWT, or resolve authentication issues and async processing challenges in cloud-native Spring applications.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add Jeffallan/claude-skills --skill java-architect

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/Jeffallan/claude-skills
cp -r claude-skills/skills/java-architect ~/.claude/skills/java-architect

Safety box score

Grade B, low risk: 21 of 100 risk points, rated 2026-10-16. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This is a documentation-only skill for building and debugging Spring Boot/Java enterprise apps; it ships no executables, only markdown guidance and code examples. The main risks are that its examples and workflow encourage running project builds/tests and handling auth, JWT, and database credentials, which can touch secrets and outbound network endpoints when implemented.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	1 (low)	It tells the agent to run local build/test commands like `./mvnw verify` and `./gradlew check`, and includes a JMH `main`, but it ships no scripts or code-evaluation machinery.
Network access	1 (low)	The examples configure outbound calls and auth discovery, e.g. `baseUrl("https://api.example.com")`, `issuer-uri`, and `jwk-set-uri`, but these are bounded app endpoints rather than arbitrary data exfiltration.
Filesystem reach	1 (low)	Its actions are project-scoped (`db/migration`, `target/site/jacoco/index.html`, editing Spring config and source files) with no dotfile, system-path, or recursive-delete behavior.
Secrets & credentials	2 (moderate)	It explicitly uses sensitive settings like `password: ${DATABASE_PASSWORD}` and `secret: ${JWT_SECRET}` and includes JWT/auth code, so it will work with credentials and tokens if followed.
Privilege & persistence	0 (none)	There is no sudo, global install, service registration, shell startup edit, or other OS-level privilege change in the files.
Instruction hijack surface	0 (none)	The skill does not tell the agent to ignore instructions, fetch remote prompt text, hide actions, or otherwise override its rules.
Irreversible actions	0 (none)	It does not deploy, publish, post, pay, book, or delete anything; it only guides local implementation and verification.
Transparency	0 (none)	All content is plain markdown and readable code examples; there are no binaries, installers, minified blobs, or decoded-at-runtime code.

Before installing

Read `references/spring-security.md` and `references/spring-boot-setup.md` to confirm where secrets come from before using real credentials.
Run the build/test commands in a scratch clone first (`./mvnw verify` or `./gradlew check`) and inspect what gets executed.
Replace the example outbound hosts (`api.example.com`, `accounts.example.com`) with approved endpoints before adopting the patterns.
Make sure no generated passwords, JWT secrets, or test credentials are committed to the repo.

Rated 2026-10-16 by an automated review of 6 files from the skill's repository.

Source

Repository: Jeffallan/claude-skills (all skills from this repository)
Path: skills/java-architect/SKILL.md
Branch: main
Updated: 2026-09-19

dotnet-core-expert — Use when building .NET 8 applications with minimal APIs, clean architecture, or cloud-native microservices. Invoke for Entity Framework Core.
secure-code-guardian — Use when implementing authentication/authorization, securing user input.
wordpress-pro — Develops custom WordPress themes and plugins, creates and registers Gutenberg blocks and block patterns, configures WooCommerce stores.
aws-auth — Adds user authentication to web and mobile apps with Amazon Cognito (user pools and identity pools) and the AWS Amplify client auth libraries.
code-reviewer — Analyzes code diffs and files to identify bugs, security vulnerabilities (SQL injection, XSS, insecure deserialization), code smells, N+1 queries.
database-optimizer — Optimizes database queries and improves performance across PostgreSQL and MySQL systems.