Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add jabrena/cursor-rules-examples --skill 124-java-secure-codinggit clone --depth 1 https://github.com/jabrena/cursor-rules-examplesWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jabrena/cursor-rules-examples/124-java-secure-coding)<a href="https://agentmods.dev/skills/jabrena/cursor-rules-examples/124-java-secure-coding"><img src="https://agentmods.dev/badge/skills/jabrena/cursor-rules-examples/124-java-secure-coding/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/jabrena/cursor-rules-examples/124-java-secure-coding"><img src="https://agentmods.dev/badge/skills/jabrena/cursor-rules-examples/124-java-secure-coding.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00080 | $0.00526 |
| Opus 5.5 | $0.00032 | $0.00210 |
| Sonnet 5.5 | $0.00016 | $0.00105 |
| Haiku 4.5 | $0.00008 | $0.00053 |
Grade A, and why
124-java-secure-coding scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Java Secure coding guidelines
Identify and apply Java secure coding practices to reduce vulnerabilities, protect sensitive data, and harden application behaviour against common attack vectors.
What is covered in this Skill?
- Input validation: type, length, format, and range checks
- SQL/OS/LDAP injection defence via
PreparedStatementand parameterized APIs - Attack surface minimisation: least-privilege permissions, removal of unused features
- Strong cryptography: BCrypt/Argon2 for passwords, AES-GCM for encryption, digital signatures; avoid deprecated ciphers (MD5, SHA-1, DES)
- Secure exception handling: log diagnostic details internally, expose only generic messages to clients
- Secrets management: load credentials from environment variables or secret managers — never hardcoded
- Safe deserialization: strict allow-lists, prefer explicit DTOs over native Java serialization
- Output encoding to prevent XSS in rendered content
Scope: The reference is organized by examples (good/bad code patterns) for each core area. Apply recommendations based on applicable examples.
Constraints
Before applying any secure coding changes, ensure the project compiles. If compilation fails, stop immediately — do not proceed until resolved. After applying improvements, run full verification.
- MANDATORY: Run
./mvnw compileormvn compilebefore applying any changes - SAFETY: If compilation fails, stop immediately — do not proceed until the project is in a valid state
- VERIFY: Run
./mvnw clean verifyormvn clean verifyafter applying improvements - BEFORE APPLYING: Read the reference for detailed good/bad examples, constraints, and safeguards for each secure coding pattern
When to use this skill
- Review Java code for secure coding
Reference
For detailed guidance, examples, and constraints, see references/124-java-secure-coding.md.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 42 lines · 80 tokens per session scan A 5e0f447c39c5
124-java-secure-coding is a skill published in the GitHub repository jabrena/cursor-rules-examples (2 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 80 tokens to every session and 526 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
temporal-python-testing
Test Temporal workflows with pytest, time-skipping, and mocking strategies. Covers unit testing, integration testing, replay testing, and local development setup. Use when implementing Temporal workflow tests or debugging test failures.
fastapi-templates
Create production-ready FastAPI projects with async patterns, dependency injection, and comprehensive error handling. Use when building new FastAPI applications or setting up backend API projects.
spring-boot-production-architecture
Production-grade Spring Boot 3.3+ architecture with Java 21, Project Loom virtual threads, layered architecture (Controller, Service, Repository, DTO), Spring Data JPA, connection pooling with HikariCP, transactional integrity, RFC 7807 ProblemDetails exception handling, and Micrometer observability. Trigger when…
uikit-expert
Write, review, or improve UIKit code following best practices for view controller lifecycle, Auto Layout, collection views, navigation, animation, memory management, and modern iOS 18–26 APIs. Use when building new UIKit features, refactoring existing views or view controllers, reviewing code quality, adopting modern…
java-code
Java development, JVM tuning, and enterprise patterns.
java-data-engineering-and-integration-services
Guides agents through Java-based data engineering services and processors. Use when building connectors, ingestion services, stream processors, metadata services, JVM batch tools, or operational integrations in Java.