124 Java Secure Coding

Community

jabrena

124-java-secure-coding

Use when you need to apply Java secure coding best practices — including validating untrusted inputs, defending against injection attacks with parameterized queries, minimizing attack surface via least privilege, applying strong cryptographic algorithms, handling exceptions securely without exposing sensitive data, managing secrets at runtime, avoiding unsafe deserialization, and encoding output to prevent XSS. This should trigger for requests such as Review Java code for secure coding; Find input validation risks in Java code; Review Java code for injection vulnerabilities; Improve secure error handling in Java services; Harden Java code against common security flaws. Part of Plinth Toolkit

Overview

Publisher	jabrena
Repository	`plinth`
Skill name	`124-java-secure-coding`
Stars	455
Forks	95
Bundled files	1
License	Apache-2.0
Links	Skill source Repository Homepage

Markdown instructions
A SKILL.md file the model loads on demand, so it only costs tokens when a request actually matches.
Works with any LLM
AI skills are plain Markdown, not provider-specific code, so this works with GPT, Claude, Gemini, Grok, or a local model.
1 bundled files
Scripts, templates, and references the model can read while it works. Files are read-only and never executed.
Open source
Published by jabrena on GitHub. Read the source before you install it.

Installation

Install the 124 Java Secure Coding AI skill in TypingMind to use it with any LLM, or drop it into another agent that reads SKILL.md.

Install in TypingMind

TypingMind installs a skill straight from its GitHub folder — it reads SKILL.md, bundles the resource files, and stores the result locally.

Open the app and go to Plugins → Skills.
Choose "Install from GitHub".
Paste the skill folder URL below and confirm.
https://github.com/jabrena/plinth/tree/main/skills/124-java-secure-coding
Enable the skill in any chat where you want it available.

Plugins → Skills → Add skill → From GitHub URL, then paste the folder URL and press Continue.

Install in another agent

Any agent that reads the Agent Skills format can use this skill — copy the folder into that agent's skills directory.

Claude Code — .claude/skills

git clone --depth 1 https://github.com/jabrena/plinth.git /tmp/plinth
mkdir -p .claude/skills
cp -r /tmp/plinth/skills/124-java-secure-coding .claude/skills/124-java-secure-coding

Restart Claude Code after copying so it picks up the new skill.

Use it in TypingMind

Enable 124 Java Secure Coding in any TypingMind chat and the model takes it from there. Its name and description sit in the system prompt, and the moment a request matches, the model loads the full instructions itself — you never invoke it by hand, and it costs no tokens until it is actually used.

The model loads 124 Java Secure Coding on its own as soon as a request matches it.

Works with any AI model

AI skills are plain Markdown instructions rather than provider-specific code, so 124 Java Secure Coding is not tied to the model it was written for. Install it once in TypingMind and use it with GPT-5, Claude, Gemini, Grok, DeepSeek, Mistral, Llama, or a local model you run yourself — all on your own API keys.

Loaded only when it is needed
The system prompt carries just the name and description. The instructions are fetched on the first matching request, so an idle skill costs nothing.
Switch models mid-chat
Because the skill is instructions rather than code, changing model does not break it — the next model reads the same SKILL.md.

Skill instructions

This is the SKILL.md content the model loads. Read it before installing — a skill is instructions your model will follow.

Java Secure coding guidelines

Identify and apply Java secure coding practices to reduce vulnerabilities, protect sensitive data, and harden application behaviour against common attack vectors.

What is covered in this Skill?

Input validation: type, length, format, and range checks
SQL/OS/LDAP injection defence via PreparedStatement and parameterized APIs
Attack surface minimisation: least-privilege permissions, removal of unused features
Strong cryptography: BCrypt/Argon2 for passwords, AES-GCM for encryption, digital signatures; avoid deprecated ciphers (MD5, SHA-1, DES)
Secure exception handling: log diagnostic details internally, expose only generic messages to clients
Secrets management: load credentials from environment variables or secret managers — never hardcoded
Safe deserialization: strict allow-lists, prefer explicit DTOs over native Java serialization
Output encoding to prevent XSS in rendered content

Scope: The reference is organized by examples (good/bad code patterns) for each core area. Apply recommendations based on applicable examples.

Constraints

Before applying any secure coding changes, ensure the project compiles. If compilation fails, stop immediately — do not proceed until resolved. After applying improvements, run full verification.

MANDATORY: Run ./mvnw compile or mvn compile before applying any changes
SAFETY: If compilation fails, stop immediately — do not proceed until the project is in a valid state
VERIFY: Run ./mvnw clean verify or mvn clean verify after applying improvements
BEFORE APPLYING: Read the reference for detailed good/bad examples, constraints, and safeguards for each secure coding pattern

When to use this skill

Review Java code for secure coding
Find input validation risks in Java code
Review Java code for injection vulnerabilities
Improve secure error handling in Java services
Harden Java code against common security flaws

Workflow

Compile project before secure-coding changes

Run ./mvnw compile or mvn compile and stop immediately if compilation fails.

Read secure-coding reference and assess risks

Read references/124-java-secure-coding.md and identify applicable vulnerabilities and hardening opportunities.

Apply secure-coding improvements

Implement selected protections for input validation, crypto, secrets, deserialization, and output encoding.

Verify with full build

Run ./mvnw clean verify or mvn clean verify after applying improvements.

Reference

For detailed guidance, examples, and constraints, see references/124-java-secure-coding.md.

Bundled files

The model reads these on demand while the skill is loaded. They are exposed as readable files and are never executed.

references/124-java-secure-coding.md34 KB

Frequently asked questions

What does the 124 Java Secure Coding AI skill do?

Why use 124 Java Secure Coding on TypingMind?

Because you install it once and use it with any model. 124 Java Secure Coding is plain Markdown rather than provider-specific code, so the same skill runs on GPT-5, Claude, Gemini, Grok, or a local model — and you can switch model mid-chat without it breaking. TypingMind runs on your own API keys, so you pay providers directly instead of a per-seat subscription, and your skills and chats stay in your own storage.

How do I install 124 Java Secure Coding in TypingMind?

Open Plugins → Skills → Install from GitHub in TypingMind and paste https://github.com/jabrena/plinth/tree/main/skills/124-java-secure-coding. TypingMind reads its SKILL.md and bundles its files and installs it as a skill you can enable per chat.

Which AI models can use 124 Java Secure Coding?

Any model you connect in TypingMind. AI skills are plain Markdown instructions rather than provider-specific code, so GPT, Claude, Gemini, Grok, and local models can all load this skill when a request matches it.

How many AI models can I use with 124 Java Secure Coding?

As many as you like. As long as a model supports skills, you can use 124 Java Secure Coding with it — GPT, Claude, Gemini, Grok, DeepSeek, Mistral, Llama and more — all on TypingMind with your own API keys.

Is the 124 Java Secure Coding AI skill free?

Yes. It is published on GitHub by jabrena under the Apache-2.0 license. You only pay your own AI provider for the tokens you use.

What are AI skills?

An AI skill is a reusable instruction bundle that teaches an AI model how to do one specific task. It follows the open Agent Skills format: a SKILL.md file with a name and description, plus any scripts, templates or reference files the model may need. The model reads the instructions only when your request matches the skill, so an installed skill costs nothing until it is used.

How are AI skills different from plugins or MCP servers?

A plugin or MCP server gives a model new tools to call — code that runs somewhere and returns a result. An AI skill gives the model knowledge and process instead: how to approach a task, which steps to follow, what good output looks like. Skills are plain Markdown, so they need no server, no API key and no runtime, and they work with any model.

View all

Openclaw Secret Scanning Maintainer

openclaw

OrganizationPopular

Triage, redact, clean up, and resolve OpenClaw GitHub Secret Scanning alerts in issues or PRs.

Release Openclaw Announcement

openclaw

OrganizationPopular

Draft or post OpenClaw beta, stable, or extended-stable Discord release announcements from changelog, tag, registry, and validation evidence. Use when announcing a release, release candidate, or…

Security Triage

Triage OpenClaw security advisories, drafts, and GHSA reports with shipped-tag and trust-model proof.

Add Model Provider

Add and live-prove a model provider with non-interactive config one-liners, without exposing credentials.

Overview

Installation

Install in TypingMind

Install in another agent

Use it in TypingMind

Works with any AI model

Skill instructions

Java Secure coding guidelines

Constraints

When to use this skill

Workflow

Reference

Bundled files

Frequently asked questions

Related AI Skills

Set up your own AI workspace now