Guide · Agent skill

How to use the Quarkus Security Review agent skill

Updated 2026-10-29 · written with AI from the project's own documentation and checked against our catalogue data

The quarkus-security skill gives an AI coding agent a reference of security practices for Quarkus, a Java framework for web services. It covers authentication with JWT and OIDC, role-based access control, input validation, CORS, password hashing, SQL injection prevention and secret handling. This guide explains what an agent skill is, how to install this one, how to ask for help so the skill is used, and what to check before you rely on the code it produces.

Quarkus Security Reviewaffaan-m/ECC · MIT Download the skill

Quick start

1Download the ZIP. Download the quarkus-security ZIP from this page. The skill contains a single file, SKILL.md.
2Unzip into a skills folder. Unzip it into ~/.claude/skills/ for personal use, or into .claude/skills/ inside your project for a project-only install.
3Or upload in the Claude apps. If you use the Claude apps, go to Settings, then Capabilities, then Skills, and upload the skill there.
4Open your Quarkus project. Start an agent session in the Quarkus Java project you want to review or extend.
5Ask a specific security question. Name Quarkus and the task, for example adding JWT authentication or checking @RolesAllowed on a resource.
6Review the output against the source. Read the code the agent proposes, compare it with the skill's examples, and replace any placeholder logic such as the always-true validator.

What is an agent skill and what does this one do?

An agent skill is a folder with a SKILL.md file that an AI agent can load when a task matches the skill's description. Once loaded, the agent follows the instructions and code patterns in that file instead of relying only on its general knowledge.

The quarkus-security skill is written in Spanish and comes from the ECC repository. Its SKILL.md contains security guidance for Quarkus, with code examples for JWT authentication, an OIDC configuration, @RolesAllowed and SecurityIdentity checks, Bean Validation DTOs, custom validators, parameterized Panache queries, BcryptUtil password hashing, CORS properties and secret handling through environment variables. It also flags insecure patterns, such as unvalidated input, string-concatenated native queries and reading X-Forwarded-For directly for rate limiting.

Authentication: JWT, OIDC and a custom Bearer token filter
Authorization: @RolesAllowed, SecurityIdentity and programmatic checks
Input validation: Bean Validation and custom constraints
SQL injection: parameterized Panache and native queries
Passwords, CORS, secrets and rate limiting

Install the quarkus-security skill

Download the ZIP for this skill from this page and unzip it. You can install it in one of two places. For a personal skill available in all your projects, unzip it into ~/.claude/skills/. For a skill that only applies to one project, unzip it into the .claude/skills/ folder inside that project.

If you use the Claude apps instead, you can upload the skill under Settings, then Capabilities, then Skills.

Personal install: ~/.claude/skills/ (available across projects)
Project install: .claude/skills/ inside your project folder
Claude apps: Settings → Capabilities → Skills, then upload

Check that the skill folder is in place

After unzipping, the skill should be a folder that contains SKILL.md. The source lists SKILL.md as the only file in this skill. Open the file to confirm it starts with a front matter block whose name is quarkus-security.

Confirm the folder contains SKILL.md
Confirm the name in the front matter is quarkus-security
Restart or reopen your agent session if it does not pick up the new folder

How to trigger the skill with natural requests

You do not need a special command. The skill's description covers Quarkus security topics, so ask in plain language and name Quarkus so the agent knows which framework applies. The skill's own trigger list includes adding authentication, implementing authorization, validating user input, configuring CORS or security headers, managing secrets, adding rate limiting, scanning dependencies for CVEs, and working with MicroProfile JWT or SmallRye JWT.

Good requests name the task, the framework and the code you want reviewed. Vague requests such as 'make this secure' work less well than a specific one.

Add JWT authentication to my Quarkus REST endpoints in this project.
Review my Quarkus resource class for missing @RolesAllowed checks.
Check my CreateUserDto for input validation problems.
Is my Quarkus CORS configuration in application.properties safe for my frontend origins?
Where should I keep the OIDC client secret in this Quarkus app?

Example: the agent reviewing a Quarkus endpoint

Suppose you paste a POST endpoint that accepts a user object without any constraints. With the skill loaded, the agent can compare it with the skill's 'bad' and 'good' pattern. The good version uses a record with @NotBlank, @Size, @Email, @Min, @Max and @Pattern annotations, and the method takes the DTO as @Valid.

For queries, the skill shows Panache parameterized queries, such as User.list with ?1 placeholders, as the safe default. It marks string concatenation inside a native query as the unsafe pattern to avoid.

// BIEN: DTO validado
public record CreateUserDto(
    @NotBlank @Size(max = 100) String name,
    @NotBlank @Email String email,
    @NotNull @Min(18) @Max(150) Integer age,
    @Pattern(regexp = "^\\+?[1-9]\\d{1,14}$") String phone
) {}

@POST
@Path("/users")
public Response createUser(@Valid CreateUserDto dto) {
  User user = userService.create(dto);
  return Response.status(Response.Status.CREATED).entity(user).build();
}

What the skill needs and what it does not do

The skill needs a Quarkus project written in Java to apply the guidance to, and an agent runtime that supports skills. According to the source, it does not run scripts and does not use the network. It is a reference the agent reads and applies to your code.

The skill's examples are illustrative. Treat them as starting points and verify them against your own Quarkus version and your identity provider.

Requires: a Quarkus (Java) project and a skill-compatible agent runtime
Runs scripts: no
Uses network: no

Safety notes before you copy any code

The sample CustomAuthFilter in the source has a validateToken method that always returns true. That means it would accept any token, so do not copy it as is. Replace it with real verification, such as the JWT or OIDC setup shown elsewhere in the skill.

The rate-limiting example includes a security note: do not use X-Forwarded-For directly, because clients can forge it. Use the real remote address of the servlet request, or an authenticated identity such as an API key or the JWT subject, when one is available.

Be aware of what the body does not cover. The description and trigger list mention CSRF protection and dependency scanning for CVEs, but the SKILL.md body does not include code for those topics. Use other tools or a dedicated review for them.

This skill is not a production security sign-off. Have a qualified reviewer check authentication, authorization and configuration before you ship.

Never copy the always-true token validator into production code
Do not trust X-Forwarded-For for rate limiting
CSRF and dependency scanning are named but not covered by code in the body
Keep secrets out of application.properties; use environment variables or a secrets store

What people use it for

Adding JWT or OIDC login to a Quarkus REST API and checking the application.properties settings
Reviewing a resource class for missing or wrong @RolesAllowed annotations and ownership checks
Tightening DTOs with Bean Validation before they reach the service layer
Checking native queries for string concatenation and rewriting them with named parameters
Moving database and OIDC secrets out of configuration files and into environment variables

Frequently asked questions

How do I install the quarkus-security skill?

Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into .claude/skills/ inside a project. In the Claude apps, you can instead upload it under Settings, then Capabilities, then Skills.

Is the quarkus-security skill free?

The source lists the licence as MIT. Check the repository licence file for the full terms before you redistribute it.

What do I need to use this skill?

You need a Quarkus project written in Java and a skill-compatible agent runtime. The skill does not run scripts and does not use the network.

Why is the skill written in Spanish?

The SKILL.md file is one of the translated documents in the ECC repository. The guidance and code comments are in Spanish, but the Quarkus APIs and annotations used are the same in English.

Can I use this skill for Spring or Node projects?

No. The skill is for Quarkus, and its APIs such as @RolesAllowed from Quarkus and Panache will not apply to Spring or Node.js code.

Is this skill enough for a production security review?

No. The examples are illustrative, and the sample token validator always returns true. Use the skill as a checklist and get a qualified review before sign-off.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

Use the quarkus-security skill if you build or review Java Quarkus REST APIs and want a checklist-style reference with working code patterns to start from. Pick something else if you need a production security sign-off or use a non-Quarkus stack such as Spring or Node, since the Quarkus-specific APIs will not apply.

Download the skill