Performs security audits on Micronaut and Kotlin backends to identify vulnerabilities and enforce best practices.
Install
mkdir -p .claude/skills/security-checklist && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/12511" && unzip -o skill.zip -d .claude/skills/security-checklist && rm skill.zipInstalls to .claude/skills/security-checklist
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Security best practices for Micronaut/Kotlin backend including authentication, authorization, input validation, and OWASP prevention. Use when implementing auth, validating inputs, or reviewing security.Key capabilities
- →Check for @Secured annotation on every controller
- →Verify user authorization before returning resources
- →Validate input parameters with @Valid and Jakarta annotations
- →Prevent SQL injection by using Exposed ORM
- →Identify common vulnerabilities like XSS and CSRF
- →Ensure secrets are managed using environment variables
How it works
The skill audits Micronaut/Kotlin backend code against a set of security rules, checking for authentication, authorization, input validation, SQL injection prevention, common vulnerabilities, secrets management, and response sanitization.
Inputs & outputs
When to use security-checklist
- →Security review of API endpoints
- →Implementing authentication
- →Validating user input DTOs
- →Preventing SQL injection
About this skill
Security Checklist
Run a security audit against Micronaut/Kotlin backend code.
When to Use
- Adding authentication or authorization to endpoints
- Validating user inputs on new or changed endpoints
- Reviewing code for security issues before merge
- Checking for common vulnerabilities (SQL injection, XSS, IDOR)
- Setting up secrets management
Process
See audit-reference.md for code examples, vulnerability table, and SAFE/DANGEROUS patterns.
- Check Authentication — every controller has @Secured, current user comes from security context
- Check Authorization — verify user has access to the resource before returning it
- Check Input Validation — @Valid on controller params, Jakarta annotations on request DTOs
- Check SQL Injection Prevention — use Exposed ORM (auto-parameterized), never raw SQL with string concat
- Check Common Vulnerabilities — SQL injection, XSS, CSRF, auth bypass, IDOR, mass assignment, data exposure, rate limiting
- Check Secrets Management — no hardcoded secrets, use env vars, never log tokens/passwords/PII, never commit .env
- Check Response Sanitization — response DTOs control what's exposed, never return raw entities
Interaction Style
- Always checks all categories, doesn't skip any section
- Flags the most dangerous issues first
- Shows code examples for every fix, not just descriptions
- Tells you what's wrong AND how to fix it
Rules
- Every endpoint must have a @Secured annotation
- Admin endpoints use OAuthSecurityRule.ADMIN
- Users can only access their own resources (or admin can access all)
- Input validated with @Valid and Jakarta annotations
- No raw SQL queries with string concatenation
- Sensitive fields excluded from response DTOs
- Tokens/passwords never logged
- Error messages don't leak internal details
- Rate limiting on auth endpoints
Output
Produces a checklist report with pass/fail for each category:
- All endpoints have @Secured annotation
- Admin endpoints use OAuthSecurityRule.ADMIN
- User can only access their own resources (or admin can access all)
- Input validated with @Valid and Jakarta annotations
- No raw SQL queries with string concatenation
- Sensitive fields excluded from response DTOs
- Tokens/passwords never logged
- Error messages don't leak internal details
- Rate limiting on auth endpoints
When not to use it
- →When the backend is not Micronaut/Kotlin
- →When the project does not involve authentication or authorization
Limitations
- →The skill is specific to Micronaut/Kotlin backend code
- →It checks for predefined security issues and rules
- →It relies on specific annotations and ORM for validation and prevention
How it compares
This skill provides code-level fixes and ensures compliance with OWASP standards, unlike a manual review that might only identify issues.
Compared to similar skills
security-checklist side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| security-checklist (this skill) | 0 | 4mo | Review | Intermediate |
| security-owasp | 0 | 2mo | No flags | Intermediate |
| backend-security-coder | 24 | 4mo | No flags | Intermediate |
| security-review | 0 | 1mo | Review | Advanced |
Try saying
Example prompts that trigger this skill in your AI assistant.
You might also like
security-owasp
navikt
OWASP Top 10:2025 kodenivå-mønstre for Kotlin, Go, Java og Node.js — tilgangskontroll, forsyningskjede, injeksjon og feilhåndtering
backend-security-coder
sickn33
Expert in secure backend coding practices specializing in input validation, authentication, and API security. Use PROACTIVELY for backend security implementations or security code reviews.
security-review
prav-raghu
Security audit for backend services and API endpoints — authentication gaps, injection risks, hardcoded secrets, and permission bypass vectors.
fullstack-guardian
Jeffallan
Use when implementing features across frontend and backend, building APIs with UI, or creating end-to-end data flows. Invoke for feature implementation, API development, UI building, cross-stack work.
mfa-on-mobile
almasumdev
Multi-factor authentication on mobile — TOTP, push-based MFA, and recovery UX. Use when adding or reviewing a second factor.
android-mobile-hardening
vongo97
Directrices de seguridad y endurecimiento (hardening) para aplicaciones Android. Úsalo al configurar el manifiesto, el almacenamiento local seguro, las firmas de red y la ofuscación en producción.