124-java-secure-coding
降低常见安全漏洞，适合开发与安全审计场景使用。
提供 Java 安全编码实践，防注入、最小权限与安全异常处理等指南。
提供 Java 安全编码的实战指南：输入校验、防注入（用 PreparedStatement 等参数化查询）、最小权限、强加密、妥善异常处理、secrets 管理和避免不安全反序列化。适用于审查 Java 代码、修复注入或敏感数据泄露风险、以及服务加固时采用。侧重具体 API 和可执行的编码改进建议。
▸ 展开 SKILL.md 英文原文
Use when you need to apply Java secure coding best practices — including validating untrusted inputs, defending against injection attacks with parameterized queries, minimizing attack surface via least privilege, applying strong cryptographic algorithms, handling exceptions securely without exposing sensitive data, managing secrets at runtime, avoiding unsafe deserialization, and encoding output to prevent XSS. This should trigger for requests such as Review Java code for secure coding; Find input validation risks in Java code; Review Java code for injection vulnerabilities; Improve secure error handling in Java services; Harden Java code against common security flaws. Part of Plinth Toolkit
帮我安装这个 skill：https://raw.githubusercontent.com/jabrena/plinth/main/skills/124-java-secure-coding/SKILL.mdcurl -fsSL "https://raw.githubusercontent.com/jabrena/plinth/main/skills/124-java-secure-coding/SKILL.md"# Java Secure coding guidelines Identify and apply Java secure coding practices to reduce vulnerabilities, protect sensitive data, and harden application behaviour against common attack vectors. **What is covered in this Skill?** - Input validation: type, length, format, and range checks - SQL/OS/LDAP injection defence via `PreparedStatement` and parameterized APIs - Attack surface minimisation: least-privilege permissions, removal of unused features - Strong cryptography: BCrypt/Argon2 for passwords, AES-GCM for encryption, digital signatures; avoid deprecated ciphers (MD5, SHA-1, DES) - Secure exception handling: log diagnostic details internally, expose only generic messages to clients