spring-boot-engineer

An agent skill by Jeffallan, from Jeffallan/claude-skills. Tags: api, architecture, java, reactive, web.

What it does

Generates Spring Boot 3.x configurations, creates REST controllers, implements Spring Security 6 authentication flows, sets up Spring Data JPA repositories, and configures reactive WebFlux endpoints. Use when building Spring Boot 3.x applications, microservices, or reactive Java applications; invoke for Spring Data JPA, Spring Security 6, WebFlux, Spring Cloud integration, Java REST API design, or Microservices Java architecture.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add Jeffallan/claude-skills --skill spring-boot-engineer

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/Jeffallan/claude-skills
cp -r claude-skills/skills/spring-boot-engineer ~/.claude/skills/spring-boot-engineer

Safety box score

Grade C, moderate risk: 28 of 100 risk points, rated 2026-10-17. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This is a documentation-only Spring Boot skill that generates application code and configuration for web, data, security, and cloud-native setups. Its main risks are not from hidden executables, but from the breadth of infrastructure it models: remote service integrations, secret-bearing config, and deployment artifacts such as Docker/Kubernetes/Actuator.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	1 (low)	The skill tells the agent to run build/test commands like `./mvnw test` and includes a Dockerfile snippet that executes `RUN ./mvnw install -DskipTests`, so it can trigger project code during builds.
Network access	2 (moderate)	It explicitly configures remote integrations and outbound calls, including `spring.cloud.config.server.git.uri: https://github.com/example/config-repo`, Zipkin, Eureka, OAuth2 issuer URLs, and `WebClient` calls to external APIs.
Filesystem reach	1 (low)	The skill is meant to generate/edit project files such as `application.yml`, `Dockerfile`, `deployment.yaml`, and Java source, but it does not direct writes outside the project tree.
Secrets & credentials	2 (moderate)	It uses secret-bearing placeholders like `${GIT_PASSWORD}`, `${CONFIG_PASSWORD}`, and `${jwt.secret}` and discusses JWT/config-server credentials, so the workflow touches sensitive values even though they are externalized.
Privilege & persistence	0 (none)	There are no instructions to use `sudo`, install globally, register services, or change shell/OS settings.
Instruction hijack surface	0 (none)	I found no prompts to ignore instructions, hide behavior, or fetch and obey remote content; the markdown references are local skill docs.
Irreversible actions	1 (low)	The skill includes deployment-oriented steps and artifacts (`Kubernetes`, `Actuator`, `POST /actuator/refresh`), but it does not itself send messages, pay, publish, or delete external resources.
Transparency	0 (none)	All shipped files are readable Markdown; there are no binaries, generated blobs, or unpinned installer downloads.

Before installing

Confirm you are okay with the skill generating cloud/deployment configs (Docker, Kubernetes, Actuator, Gateway).
Make sure any real values for `GIT_PASSWORD`, `CONFIG_PASSWORD`, and `jwt.secret` stay in your secret store, not in repo files.
If you don't want outbound integrations, avoid the Cloud/Tracing/WebClient examples or sandbox them first.
Run it in a scratch branch so you can inspect any generated `application.yml`, `Dockerfile`, or `deployment.yaml` before committing.

Rated 2026-10-17 by an automated review of 6 files from the skill's repository.

Source

Repository: Jeffallan/claude-skills (all skills from this repository)
Path: skills/spring-boot-engineer/SKILL.md
Branch: main
Updated: 2026-09-19

api-designer — Use when designing REST or GraphQL APIs, creating OpenAPI specifications, or planning API architecture.
graphql-architect — Use when designing GraphQL schemas, implementing Apollo Federation, or building real-time subscriptions.
java-architect — Use when building, configuring, or debugging enterprise Java applications with Spring Boot 3.x, microservices.
aws-auth — Adds user authentication to web and mobile apps with Amazon Cognito (user pools and identity pools) and the AWS Amplify client auth libraries.
aws-blocks — Guides building full-stack applications with AWS Blocks — an Infrastructure-from-Code framework.
aws-networking — Routes AWS networking requests to the correct service skill for implementation.