Create Spring Boot Java Project — Agent Skill by GitHub

From the author

Create a new Spring Boot Java project (Maven or Gradle) from start.spring.io with sensible defaults for configuration, PostgreSQL, logging, security, testing and Docker. Use when asked to scaffold, bootstrap or generate a Spring Boot application. Detects existing project versions and never upgrades implicitly.

— the description by wuwen5

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill automates the creation of Spring Boot applications by interacting with the start.spring.io API. It provides a structured approach to bootstrapping projects using either Maven or Gradle, while applying opinionated defaults for configuration, database connectivity, logging, security, and containerization. The skill includes logic to detect existing project structures to prevent accidental overwrites or unauthorized version upgrades, ensuring consistency across the development lifecycle.

What it does

Generates new Spring Boot projects via start.spring.io API
Supports both Maven and Gradle build systems
Applies standardized configurations for PostgreSQL, logging, and security
Detects existing project files to avoid regeneration
Provides Dockerfile templates for JVM and native images
Verifies project setup through build and health check commands

When to use it

When you need to bootstrap a new Spring Boot application
When you require a consistent project structure with standard dependencies
When you need to integrate PostgreSQL, Testcontainers, or Docker support
When you need to ensure configuration best practices like externalized secrets

Advantages

Ensures consistent project structure and dependency management
Prevents accidental version upgrades in existing projects
Automates the setup of essential development and testing tools
Reduces manual configuration effort for standard Spring Boot features

Usage examples

“Create a new Spring Boot project named my-app using Maven.”: The agent will generate a new Spring Boot project structure in a directory named my-app using Maven, including default dependencies and configuration files.
“Bootstrap a Spring Boot application with PostgreSQL and security.”: The agent will scaffold a project with the necessary dependencies for JPA, PostgreSQL, and Spring Security, and configure the initial application properties.

Install

Download the skill as a ZIP:
https://mp-staging.autogineer.com/agent-skills/github/create-spring-boot-java-project/download

Unzip it into the cross-client skills folder of your project:

mkdir -p .agents/skills && unzip create-spring-boot-java-project.zip -d .agents/skills

Documentation by wuwen5

Create a Spring Boot Java project

Scaffold a Spring Boot application with start.spring.io, then apply a small set of opinionated defaults. Out of scope for now: front-ends (Vue/React/Angular), cloud deployment (Azure), Git setup, CRaC and AOT images.

Step 0: Detect before you create

If the working directory already contains a pom.xml or build.gradle(.kts), this is an existing project: do not regenerate it. Read its Spring Boot, Java and test-framework versions and follow them. Never upgrade versions implicitly; propose an upgrade and wait for the user's decision.
Check the tools: java -version (JDK matching the chosen Java version), docker --version (needed for Testcontainers and Compose). On the default path (current Boot via start.spring.io) Maven/Gradle need not be installed: the generated wrapper is used. The Boot 3.5 fallback needs Maven or Gradle installed once to create the wrapper (see versions.md).
Ask only for what is missing: project name, group id, package, build tool (default Maven), dependencies (default: web, actuator, validation, devtools; add data-jpa, postgresql, security, docker-compose, testcontainers when a database or auth is needed).

Step 1: Resolve versions

Follow references/versions.md: query https://start.spring.io/metadata/client at run time for the latest stable Spring Boot release, fall back to the documented pinned values if offline. Do not hardcode latest anywhere.

Step 2: Generate the project

Use the start.spring.io HTTP API with explicit, pinned parameters (no piped installers). Replace the values in capitals.

Maven:

curl -fsS https://start.spring.io/starter.zip \
  -d type=maven-project -d language=java -d packaging=jar \
  -d bootVersion=BOOT_VERSION -d javaVersion=JAVA_VERSION \
  -d groupId=com.example -d artifactId=demo -d name=demo \
  -d packageName=com.example.demo -d baseDir=demo \
  -d dependencies=web,actuator,validation,devtools \
  -o demo.zip && unzip -q demo.zip && rm demo.zip

Gradle: same command with -d type=gradle-project (Groovy DSL) or -d type=gradle-project-kotlin (Kotlin DSL; the language stays java).

Inspect the result (ls demo, read the build file) and make sure the wrapper (mvnw or gradlew) is executable. Add -d dependencies=...,data-jpa,postgresql,docker-compose,testcontainers for a database project.

Step 3: Apply the defaults

Area	What to do	Reference
Boot 3 vs 4 differences	Starter names, Jackson 3, test modules	references/spring-boot-4.md
Configuration	`application.properties` or `.yml` (match the project), profiles, `@ConfigurationProperties`, secrets via environment	references/configuration.md
Database	PostgreSQL, Hibernate settings, Compose for dev, Testcontainers for tests	references/database.md
Logging	SLF4J, parameterized messages, levels, structured logging	references/logging.md
Security	Spring Security basics, secure defaults, Problem Details	references/security.md
Docker	JVM image and GraalVM native image Dockerfiles	references/docker.md
Testing	See the `spring-boot-testing` skill (slices, Testcontainers, Failsafe)	`skills/spring-boot-testing`
Best practices	See the `java-springboot` skill and `instructions/springboot.instructions.md`	`skills/java-springboot`

Keep dotfiles minimal: a .gitignore covering target/, build/, .gradle/, IDE folders and .env; never commit .env (commit a .env.sample).

Step 4: Verify

Build and test: ./mvnw verify (Maven) or ./gradlew build (Gradle).
Run: ./mvnw spring-boot:run or ./gradlew bootRun, then curl -fsS localhost:8080/actuator/health must return {"status":"UP"}.
Report the chosen versions and anything that was skipped or deferred.

Provenance

Adapted from the Apache-2.0 skill jdubois/dr-jskill; see references/PROVENANCE.md.

Files

ATTRIBUTION.mdAdded by AutoGineer891 B
LICENSELicence file added by AutoGineer1.0 KiB
SKILL.md4.5 KiB
assets/Dockerfile2.1 KiB
assets/Dockerfile-gradle2.5 KiB
assets/Dockerfile-native1.2 KiB
assets/Dockerfile-native-gradle1.3 KiB
references/PROVENANCE.md1.7 KiB
references/configuration.md2.2 KiB
references/database.md3.4 KiB
references/docker.md4.4 KiB
references/logging.md1.6 KiB
references/security.md2.4 KiB
references/spring-boot-4.md2.2 KiB
references/versions.md2.6 KiB

references/security.md

Security basics

For anything beyond the basics (OAuth2/OIDC, JWT resource server, method security, CSRF/CORS details, testing security) use the spring-security skill. This page covers secure defaults when scaffolding.

Dependencies

Add security at generation time (Boot 4: spring-boot-starter-security, plus spring-boot-starter-security-test in test scope if generated by start.spring.io). Adding it secures every endpoint by default.

Minimal explicit configuration

@Configuration
@EnableWebSecurity
class SecurityConfig {

    @Bean
    SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/actuator/health/**", "/actuator/info").permitAll()
                .anyRequest().authenticated())
            .httpBasic(Customizer.withDefaults());
        return http.build();
    }

}

For local development, leave Boot's generated user and password encoder setup intact. Do not add a PasswordEncoder bean alone: Boot's generated password is then left unencoded and cannot authenticate with a delegating encoder.
Deny by default: anyRequest().authenticated() last.
Keep CSRF enabled for browser sessions; disable it only for stateless token APIs, deliberately.
For production password authentication, configure a persistent user store and a matching PasswordEncoder together. Use PasswordEncoderFactories.createDelegatingPasswordEncoder() and store its encoded {id}hash values, never plain text.
Do not use {noop} passwords or InMemoryUserDetailsManager demo users outside local experiments.

Secure defaults checklist

[ ] Secrets from environment/secret store, never committed (see configuration.md)
[ ] Expose only health and info over HTTP: management.endpoints.web.exposure.include=health,info
[ ] Validate input (@Valid, Bean Validation) and use parameterized queries / Spring Data
[ ] Error responses via RFC 9457 Problem Details: spring.mvc.problemdetails.enabled=true; no stack traces to clients (server.error.include-stacktrace=never)
[ ] CORS configured explicitly with allowed origins, never * with credentials
[ ] HTTPS terminated at the platform; server.forward-headers-strategy=framework behind a proxy
[ ] Dependencies kept current; container runs as non-root (see docker.md)

Requirements and compatibility

Written for: GitHub Copilot

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs network access

Security

What our scanner noticed· Low risk

Instructions that use the network

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Implement
Matt Pocock· Community
A structured workflow for implementing software tasks from specifications or tickets.
Software developmentClaude CodeClaude appsOpenAI Codex+14 more
MITGitHub stars of the source repository317.5k
Source Driven Development
Addy Osmani· Community
A rigorous process for grounding code implementation in official, version-specific documentation to ensure accuracy and avoid outdated patterns.
Software developmentClaude CodeClaude appsOpenAI Codex+14 more
MITGitHub stars of the source repository113.9k
Write Swift
Emil Kowalski· Community
A comprehensive guide to writing modern, safe, and performant Swift code following the language's latest idioms and concurrency models.
Software developmentClaude CodeClaude appsOpenAI Codex+14 more
MITGitHub stars of the source repository54.3k
Cardputer Buddy
AnthropicOfficial
Iterate on the Cardputer-Adv MicroPython app bundle (Claude Buddy, Snake, Hello) after the device is already provisioned via m5-onboard. Use when the user wants to add a new app, push a single changed .py without re-flashing, watch device serial logs, or run a one-shot REPL command. Trigger on "add an app", "push to the cardputer", "tail the device", "run on the device", or follow-up work after /maker-setup.
Software developmentClaude CodeClaude appsOpenAI Codex+14 more
Apache-2.0GitHub stars of the source repository46.3k
Typescript Pro
Seth Hobson· Community
An expert TypeScript persona focused on advanced typing, enterprise architecture, and strict type safety.
Software developmentClaude Code
MITGitHub stars of the source repository42.3k
Scala Pro
Seth Hobson· Community
An expert Scala engineer persona specializing in functional programming, distributed systems, and enterprise-grade architecture.
Software developmentClaude Code
MITGitHub stars of the source repository42.3k

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download create-spring-boot-java-project.zip