Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/jabrena/cursor-rules-examples/124-java-secure-codingnpx skills add jabrena/cursor-rules-examples --skill 124-java-secure-codinggit clone --depth 1 https://github.com/jabrena/cursor-rules-examplesWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00080 | $0.00526 |
| Opus 5 | $0.00040 | $0.00263 |
| Sonnet 5 | $0.00016 | $0.00105 |
| Haiku 4.5 | $0.00008 | $0.00053 |
Grade A, and why
124-java-secure-coding scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Java Secure coding guidelines
Identify and apply Java secure coding practices to reduce vulnerabilities, protect sensitive data, and harden application behaviour against common attack vectors.
What is covered in this Skill?
- Input validation: type, length, format, and range checks
- SQL/OS/LDAP injection defence via
PreparedStatementand parameterized APIs - Attack surface minimisation: least-privilege permissions, removal of unused features
- Strong cryptography: BCrypt/Argon2 for passwords, AES-GCM for encryption, digital signatures; avoid deprecated ciphers (MD5, SHA-1, DES)
- Secure exception handling: log diagnostic details internally, expose only generic messages to clients
- Secrets management: load credentials from environment variables or secret managers — never hardcoded
- Safe deserialization: strict allow-lists, prefer explicit DTOs over native Java serialization
- Output encoding to prevent XSS in rendered content
Scope: The reference is organized by examples (good/bad code patterns) for each core area. Apply recommendations based on applicable examples.
Constraints
Before applying any secure coding changes, ensure the project compiles. If compilation fails, stop immediately — do not proceed until resolved. After applying improvements, run full verification.
- MANDATORY: Run
./mvnw compileormvn compilebefore applying any changes - SAFETY: If compilation fails, stop immediately — do not proceed until the project is in a valid state
- VERIFY: Run
./mvnw clean verifyormvn clean verifyafter applying improvements - BEFORE APPLYING: Read the reference for detailed good/bad examples, constraints, and safeguards for each secure coding pattern
When to use this skill
- Review Java code for secure coding
Reference
For detailed guidance, examples, and constraints, see references/124-java-secure-coding.md.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 42 lines · 80 tokens per session scan A 5e0f447c39c5
124-java-secure-coding is a skill published in the GitHub repository jabrena/cursor-rules-examples (2 stars, last pushed 5d ago), licensed Apache-2.0. It adds 80 tokens to every session and 526 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
complexity
Wire and satisfy cyclomatic complexity lint. Detect the repo's existing linter, set or keep a cap (default 10), extract until green, never disable the rule. Use when complexity.mdc globs match, lint reports C901/complexity, or the user asks for simpler / less nested code.
uikit-expert
Write, review, or improve UIKit code following best practices for view controller lifecycle, Auto Layout, collection views, navigation, animation, memory management, and modern iOS 18–26 APIs. Use when building new UIKit features, refactoring existing views or view controllers, reviewing code quality, adopting modern…
debugging
Debugs difficult, intermittent, cross-layer, or regression bugs evidence before fixes. Use when the cause is unknown, normal debugging stalled, or the user asks to hunt, diagnose, or root-cause a bug.
testing
Test writing workflows: TDD order, mocks, house gauntlet, regression naming. Use when writing/editing tests or when testing.mdc globs match. Thin rule = roofs; this skill = procedure.
design-stack
Router for Mario's Design agent. Picks one UI skill plus premium-ui-craft. Use at the start of any Product Designer / @Design / UX/UI turn.
now
Write or resume NOW.md (session state). Use when continuing tomorrow, switching chats/models, pausing a feature, or the user mentions NOW.md, session continuity, or the old name handoff.