Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add joaquimscosta/arkhe-claude-plugins --skill spring-boot-scannergit clone --depth 1 https://github.com/joaquimscosta/arkhe-claude-pluginsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/joaquimscosta/arkhe-claude-plugins/spring-boot-scanner)<a href="https://agentmods.dev/skills/joaquimscosta/arkhe-claude-plugins/spring-boot-scanner"><img src="https://agentmods.dev/badge/skills/joaquimscosta/arkhe-claude-plugins/spring-boot-scanner/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/joaquimscosta/arkhe-claude-plugins/spring-boot-scanner"><img src="https://agentmods.dev/badge/skills/joaquimscosta/arkhe-claude-plugins/spring-boot-scanner.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00116 | $0.01486 |
| Opus 5.5 | $0.00046 | $0.00594 |
| Sonnet 5.5 | $0.00023 | $0.00297 |
| Haiku 4.5 | $0.00012 | $0.00149 |
Grade A, and why
spring-boot-scanner scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 135 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Spring Boot Scanner
Smart pattern detection and skill routing for Spring Boot projects.
Core Behavior
Trigger Conditions:
- Editing
*.javaor*.ktfiles in a project withspring-boot-starterdependencies - Working with
pom.xmlorbuild.gradle*containing Spring Boot - User mentions "Spring Boot", "Spring Security", "Spring Data", etc.
Action: Scan code → Detect patterns → Route to appropriate skill
Detection Algorithm
Scans in 3 phases: (1) detect Spring Boot project via build files, (2) scan annotations against the map below, (3) route by risk level — LOW auto-invokes, HIGH confirms first. See WORKFLOW.md for the full step-by-step detection flow.
Annotation → Skill Map
| Annotation Pattern | Detected Skill | Risk Level |
|---|---|---|
@RestController, @GetMapping, @PostMapping, @RequestMapping |
spring-boot-web-api | LOW |
@Entity, @Repository, @Aggregate, @MappedSuperclass |
spring-boot-data-ddd | LOW |
@Service in **/domain/** or **/service/** |
domain-driven-design | LOW |
@ApplicationModule, @ApplicationModuleListener |
spring-boot-modulith | LOW |
@Timed, @Counted, HealthIndicator, MeterRegistry |
spring-boot-observability | LOW |
@EnableWebSecurity, @PreAuthorize, @Secured, SecurityFilterChain |
spring-boot-security | HIGH |
@SpringBootTest, @WebMvcTest, @DataJpaTest, @MockitoBean |
spring-boot-testing | HIGH |
@MockBean (deprecated) |
spring-boot-testing | HIGH + WARNING |
| Build file with version < 4.0 | spring-boot-verify | HIGH |
Use this script to detect patterns:
# Run from project root
python3 scripts/detect_patterns.py /path/to/file.java
Or use Grep directly:
# Web API detection
grep -l "@RestController\|@GetMapping\|@PostMapping" **/*.java
# Security detection
grep -l "@EnableWebSecurity\|@PreAuthorize\|SecurityFilterChain" **/*.java
# Testing detection
grep -l "@SpringBootTest\|@WebMvcTest\|@MockitoBean\|@MockBean" **/*.java
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 135 lines · 116 tokens per session scan A 563c767c63a1
spring-boot-scanner is a skill published in the GitHub repository joaquimscosta/arkhe-claude-plugins (21 stars, last pushed yesterday), licensed MIT. It adds 116 tokens to every session and 1,486 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-16.
Other skills, from other repositories
low-code-platforms
Low-code and internal tool platforms including Retool, Supabase, Appsmith, Tooljet, n8n, and Zapier. Use when building admin panels, internal tools, workflow automations, or integrating low-code platforms with custom code.
oracle-adk
Build production agentic applications on OCI with Oracle's Agent Development Kit — multi-agent orchestration, function tools, and enterprise patterns. Use when developing agents on OCI with the Oracle ADK or integrating Oracle enterprise services into an agent.
langgraph-patterns
Production-grade agentic workflows with LangGraph — graph orchestration, state machines, human-in-the-loop, and advanced control flow. Use when building or debugging a LangGraph app, modeling agent state, or adding checkpoints and human approval steps.
spring-shell
Spring Shell for building interactive CLI applications. Covers @ShellComponent, @ShellMethod, input validation, tables, and command groups. USE WHEN: user mentions "spring shell", "@ShellComponent", "@ShellMethod", "CLI application Spring", "interactive shell", "command line tool Spring" DO NOT USE FOR: simple scripts…
secret-warn
Use when adding or tuning edit-time secret and code-injection guardrails or security hooks in Claude Code, or on mentions of secret detection, API key safety, hardcoded or leaked keys (AWS, Stripe, GCP, OpenAI, Anthropic, GitHub, Slack, JWT, PEM, .env), gitleaks-style or pre-commit secret scanning, false positives or…
huggingface-community-evals
Run evaluations for Hugging Face Hub models using inspect-ai and lighteval on local hardware. Use for backend selection, local GPU evals, and choosing between vLLM / Transformers / accelerate. Not for HF Jobs orchestration, model-card PRs, .evalresults publication, or community-evals automation.