spring-boot-skill — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited spring-boot-skill (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Apply the practices below when developing Spring Boot applications. Read the linked reference only when working on that area.
Read references/spring-boot-maven-config.md for Maven pom.xml configuration with supporting plugins and configurations to improve code quality, and testing.
Read references/code-organization.md for domain-driven, module-based package layout and naming conventions.
Implement the repository and entity layer using references/spring-data-jpa.md.
Implement business logic in the service layer using references/spring-service-layer.md.
Implement REST APIs with Spring MVC using references/spring-webmvc-rest-api.md.
Build a modular monolith with Spring Modulith using references/spring-modulith.md.
If Thymeleaf is used for view templates, refer references/thymeleaf.md
Write tests at complementary levels — unit, sliced Spring tests, and at least one end-to-end/smoke test; the levels are not either/or. Most framework-touching tests belong at the fast sliced level (@SpringBootTest(classes = …) or a slice annotation); keep full-context @SpringBootTest for a smoke test plus a request-level end-to-end. For why the levels are complementary and how to keep a large suite fast (context caching, one container for the suite), read references/testing-strategy.md.
| What you're testing | Level | Reference |
|---|---|---|
| Business/domain logic, no framework | Unit (no Spring context) | testing-unit-mocking.md |
| JPA / JDBC / JdbcClient / Spring Data JDBC / jOOQ queries | Persistence slice + Testcontainers | testing-slices-persistence.md |
| Controller, JSON serialization, or a REST client | Web slice (@WebMvcTest/@JsonTest/@RestClientTest) | testing-slices-web.md |
| A few components together, external HTTP (WireMock), or a startup/request-level smoke test | Sliced @SpringBootTest(classes = …) or smoke test | testing-integration.md |
Full REST API over a real port, full BaseIT suite (RestTestClient) | End-to-end | spring-boot-rest-api-testing.md |
A view-rendering controller (MockMvcTester) | Web slice | spring-boot-webapp-testing-with-mockmvctester.md |
Wiring a container (@ServiceConnection / dynamic properties) | — | testcontainers-wiring.md |
All persistence and integration tests use Testcontainers with a real database (never in-memory H2); see references/testcontainers-wiring.md for @ServiceConnection vs dynamic-property wiring.
Prefer SQL fixtures with @Sql("classpath:/test-data.sql") before every test method. When setting up data programmatically, prefer exposed Services or ModuleAPI classes over Repositories, JdbcTemplate, or JdbcClient. Unless absolutely necessary, avoid using JdbcTemplate, JdbcClient, or TransactionTemplate to execute SQL for test data setup, which couples tests to internal implementation details. Read references/test-data-setup.md when creating or changing test fixtures.
To write tests for testing the architecture using ArchUnit, refer references/archunit.md
To use Docker Compose support for local development, refer references/spring-boot-docker-compose.md.
Use references/taskfile.md for easier commands execution.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.