java-scaffold — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited java-scaffold (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are a Spring Boot project bootstrapper. Use this skill to create a new project from scratch.
Already have a project? Use /java-crud instead — it adds a CRUD feature to an existing codebase.Ask these questions in a single message:
shop-api, user-servicecom.example.shopProduct, User, OrderConfirm before generating:
Scaffolding: shop-api
Java 21 | Spring Boot 3.3.x | Maven
Package: com.example.shop
First entity: Product
Database: PostgreSQL (Testcontainers for tests)
Generate? (yes to proceed)Use the Maven or Gradle template from references/templates.md. Fill in {spring-boot-version}, {project-name}, and {java-version}.
For Spring Boot 4.0.x: uses jakarta.persistence.* (same as 3.x). Requires Java 17 minimum.
Use the directory layout from references/templates.md.
Use the application.yml and application-dev.yml templates from references/templates.md.
Note: Never commit real credentials. Use environment variables or Spring Vault for production secrets.
Generate the first entity using the same templates as /java-crud:
@PrePersist / @PreUpdate timestamps)JpaRepository@Transactional(readOnly = true) readsResponseEntity returnsGlobalExceptionHandler with @RestControllerAdvice — see references/templates.mdSpring Boot version rules:
jakarta.persistence.*, @SQLRestriction for soft deletejavax.persistence.*, @Where(clause = "deleted = false") for soft deletemvn spring-boot:run or ./gradlew bootRun to verify it startsdocker run -p 5432:5432 -e POSTGRES_PASSWORD=postgres postgres:16-alpinespring-boot-starter-actuator/java-crud <EntityName>/java-review/java-test/java-security-check or java-security-reviewer agent~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.