The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The file examples/bad-security-config.java contains a hardcoded secret string literal. While explicitly marked as an anti-pattern ("❌ BAD"), this represents a credential exposure finding to illustrate unsafe development practices.
[INDIRECT_PROMPT_INJECTION]: The skill implements a mechanism to ingest and process Bearer tokens from the Authorization header, which is a potential surface for indirect prompt injection.
Ingestion points: templates/JwtAuthenticationFilter.java extracts content from the Authorization request header.
Boundary markers: The implementation uses JwtService.validateAccessTokenAndGetSubject(token) to validate token integrity and the reject(response) method to terminate unauthorized requests.
Capability inventory: The filter has the capability to modify the SecurityContextHolder and control the execution of the filterChain.
Sanitization: Input is sanitized using the JJWT library's cryptographic signature verification and expiration checking before the user details are loaded.

spring-security-jwt