Security Anti-Patterns for Java

AI coding agents write insecure code. Not maliciously - they just optimize for "works" over "safe." This skill fixes that.

The problem

Ask Claude, Codex, or any AI to query a database. You'll probably get something like:

// AI-generated code - looks fine, isn't
String query = "SELECT * FROM users WHERE email = '" + email + "'";
Statement stmt = conn.createStatement();
ResultSet rs = stmt.executeQuery(query);  // SQL injection waiting to happen

The AI didn't know better. It generated statistically likely Java code. Unfortunately, statistically likely often means copied from tutorials circa 2010.

This skill teaches the AI to catch these patterns and fix them before they hit your codebase.

What it catches

11 modules covering OWASP Top 10 Web and API vulnerabilities:

Module	What it prevents
injection.md	SQL injection, command injection, JPQL/HQL injection, LDAP injection
deserialization.md	ObjectInputStream attacks, XXE, unsafe YAML
xss-output.md	Cross-site scripting, missing template escaping in JSP/Thymeleaf
auth-access.md	Broken access control, BOLA, session issues, JWT misuse
crypto-secrets.md	Weak hashing, hardcoded secrets, bad randomness
input-validation.md	Missing Bean Validation, file upload attacks, mass assignment
file-operations.md	Path traversal, insecure temp file creation
spring-security.md	CSRF bypass, permissive CORS, exposed actuators
jakarta-ee.md	Servlet security, EJB patterns, JAX-RS issues
dependencies.md	Supply chain attacks, vulnerable Log4j, typosquatting
java-runtime.md	Reflection dangers, ReDoS, ScriptEngine abuse

The short version

• Never string concatenation in SQL. Use PreparedStatement or JPA named parameters.
• Never ObjectInputStream.readObject() on untrusted data. Use JSON.
• Never Runtime.exec() with user input. Use ProcessBuilder with argument list.
• Never java.util.Random for security. Use SecureRandom.
• Never MD5/SHA1 for passwords. Use BCrypt or Argon2.
• Never th:utext in Thymeleaf. Use th:text.

Each module has BAD and GOOD examples so you can see exactly what to avoid.

Supported platforms

Platform	Status
Claude Code	Works
OpenAI Codex	Works
Google Antigravity	Works
Warp	Works
VS Code Copilot	Works

This skill follows the Agent Skills open standard. If your AI tool supports skills, this works.

Installation

Claude Code

Clone to your skills directory:

git clone https://github.com/subhashdasyam/security-antipatterns-java ~/.claude/skills/security-antipatterns-java

Or for a specific project, clone to .claude/skills/ in the repo.

OpenAI Codex CLI

mkdir -p ~/.codex/skills
ln -s $(pwd) ~/.codex/skills/security-antipatterns-java

Google Antigravity

mkdir -p ~/.antigravity/skills
ln -s $(pwd) ~/.antigravity/skills/security-antipatterns-java

Warp Terminal

Copy to ~/.warp/skills/ or configure the skill path in Warp settings.

VS Code Copilot

Copy the skill folder to .github/skills/ in your project.

Any other tool

Copy or symlink this folder to wherever your AI tool looks for skills. The format is standard - it should just work.

When it activates

The skill kicks in when you're generating:

• Spring Boot controllers or services
• JPA/Hibernate entity operations
• JDBC queries
• Jakarta EE servlets or JAX-RS endpoints
• File handling code
• Authentication or session logic
• Anything deserializing external data

Java version support

• Java 17 (primary target - most widely used LTS)
• Java 11 (secondary - still common in enterprise)
• Java 21 (latest LTS - modern features)

Patterns work across all three. Version-specific features (sealed classes, records, virtual threads) are noted where relevant.

License

MIT