Quarkus Security Review

What it does

When installed, the agent gets a reference of security practices for Quarkus, a Java framework for web services. When you ask for help with login, JWT or OIDC tokens, role-based access, input validation, CORS, password hashing, SQL injection prevention or secret handling, it follows these patterns and points out insecure examples such as unvalidated input or string-concatenated queries. The skill is written in Spanish and is one of the translated documents in the ECC repository.

Try asking

• “Revisa mi API Quarkus y dime si los endpoints de administración están bien protegidos con @RolesAllowed”Copy
• “Ayúdame a configurar OIDC con Keycloak en application.properties sin dejar secretos en el código”Copy
• “Revisa mis consultas nativas en Panache y detecta posibles inyecciones SQL”Copy

Get better results

• Ask for a review of your specific files rather than general advice, so the agent checks against your actual configuration.
• Verify every recommendation against current Quarkus documentation and your identity provider's settings before deploying.
• Treat code samples as starting points: the JWT filter example accepts any Bearer token and the CORS example enables credentials, so adapt them carefully.

What's inside

• SKILL.md