Install
$ agentstack add skill-rashidee-co2-skills-specgen-spring-jpa-jtehtmx Open-source listing, not yet scanned by AgentStack. Follow the source repository for install instructions.
Security review
⚠ Flagged1 finding(s); flagged for manual review. · v0.1.0 How review works →
- • Prompt-injection patterns
- • Secret / credential exfiltration
- • Dangerous shell & filesystem operations
- • Untrusted network calls
- • Known-malicious package signatures
- high Dangerous shell/eval execution.
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ● Environment & secrets Used
- ● Dynamic code execution Used
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Spring Boot Web Application Specification Generator
This skill generates a comprehensive specification document (Markdown) that serves as a blueprint for building a monolith Spring Boot 3 web application with server-rendered views. The spec is intended to be followed by a developer or a coding agent to produce a fully functional project scaffold.
The specification does NOT generate code. It produces a detailed, opinionated technical document describing every layer of the application — from Maven configuration to JTE layouts to security filter chains — so that implementation becomes a mechanical exercise.
Technology Stack
Core Stack (Always Included)
These are the fixed versions the spec targets. Do not deviate unless the user explicitly requests different versions.
| Component | Version | |--------------------|-----------| | Java JDK | 21 | | Spring Boot | 3.5.7 | | Maven | 4.0.0 | | JTE | 3.2.1 | | Tailwind CSS | 4.x | | Alpine.js | 3.x | | htmx | 2.x | | Vite | 6.x |
Optional Integration Versions
Include in the version table only when the corresponding integration is selected.
| Component | Version | When Selected | |--------------------|-----------|----------------------| | MongoDB | 8.0.19 | Database = MongoDB | | PostgreSQL | 17.x | Database = PostgreSQL| | MySQL | 8.4.x | Database = MySQL | | Keycloak | 26.5.3 | Auth = Keycloak | | RabbitMQ | 4.x | Messaging = yes OR Remote Partitioning = yes |
Core Dependencies
The spec must include these in the Maven configuration section (always):
- Spring Web (starter-web)
- Spring Modulith (core, events-api)
- JTE Spring Boot Starter (
gg.jte:jte-spring-boot-starter-3) - JTE precompiler (
gg.jte:jte-maven-pluginwithprecompilegoal atprocess-classesphase, output totarget/classesso precompiled templates are included in the Spring Boot fat JAR) - Lombok
- Spring Boot DevTools
- MapStruct (with annotation processor)
- frontend-maven-plugin (for Node/Vite build)
Conditional Dependencies
If Database = MongoDB:
- Spring Data MongoDB (
spring-boot-starter-data-mongodb) - MongoDB Driver
- Spring Modulith starter-mongodb (
spring-modulith-starter-mongodb)
If Database = PostgreSQL or MySQL:
- Spring Data JPA (
spring-boot-starter-data-jpa) - PostgreSQL driver (
org.postgresql:postgresql) or MySQL driver (com.mysql:mysql-connector-j) - Flyway (
org.flywaydb:flyway-core) for schema migration - Spring Modulith starter-jpa (
spring-modulith-starter-jpa)
If Auth = Keycloak:
- Spring Security (
spring-boot-starter-security) - Spring Security OAuth2 Client (
spring-boot-starter-oauth2-client)
If Auth = Spring Security (form login):
- Spring Security (
spring-boot-starter-security)
If Scheduling = yes:
- Spring Quartz (
spring-boot-starter-quartz) - If Database = MongoDB:
io.fluidsonic.mirror:fluidsonic-mirror-quartz(MongoDB job store for Quartz) - If Database = PostgreSQL/MySQL: Quartz JDBC job store (built-in)
If Scheduling = yes AND Spring Batch = yes:
- Spring Batch (
spring-boot-starter-batch)
If Scheduling = yes AND Spring Batch = yes AND Remote Partitioning = yes:
- Spring Batch Integration (
spring-batch-integration) - Spring Integration AMQP (
spring-integration-amqp) - Spring Boot AMQP Starter (
spring-boot-starter-amqp)
If Messaging = yes:
- Spring Boot AMQP Starter (
spring-boot-starter-amqp)
(shared with Remote Partitioning — if both are selected, include the dependency once)
If i18n = yes:
- No extra dependency — uses Spring's built-in
MessageSource(part ofspring-context,
already on the classpath via starter-web). Resource bundles under src/main/resources/i18n/, a CookieLocaleResolver, and a LocaleChangeInterceptor provide locale resolution and switching; a small Localizer helper exposes messages to JTE templates.
If Reporting = yes:
- JasperReports (
net.sf.jasperreports:jasperreports:7.0.3) — report engine with JRDesign API for programmatic layout - JasperReports Fonts (
net.sf.jasperreports:jasperreports-fonts:7.0.3) - OpenPDF (
com.github.librepdf:openpdf:2.0.4) — PDF export engine for JasperReports 7.x - Apache POI OOXML (
org.apache.poi:poi-ooxml:5.4.1) — XLSX export support
When the Skill Triggers
Generate the spec when the user provides an application name and version that corresponds to one of the custom applications defined in CLAUDE.md. The skill reads all required inputs from the project's context files — no interactive Q&A is needed for the core inputs.
The user invokes this skill by specifying the target application and version, for example:
/specgen-spring-jpa-jtehtmx hub_middleware v1.0.3/specgen-spring-jpa-jtehtmx hub_middleware v1.0.3 module:Location Information/specgen-spring-jpa-jtehtmx "Hub Middleware" v1.0.3
The skill then locates the matching context folder and reads all input files automatically.
Version Gate
Before starting any work, resolve the application folder first (see Input Resolution below), then check CHANGELOG.md in the application folder (/CHANGELOG.md):
- If
/CHANGELOG.mddoes not exist, skip this check (first-ever execution for this application). - If
/CHANGELOG.mdexists, scan all## vX.Y.Zheadings and determine the highest version using semantic versioning comparison. - Compare the requested version against the highest version:
- If requested version >= highest version: proceed normally.
- If requested version **/CHANGELOG.md. Execution rejected."` Do NOT proceed with any work.
Input Resolution
This skill uses standardized input resolution. Provide:
| Argument | Required | Example | Description | |----------|----------|---------|-------------| | ` | Yes | hub_middleware | Application name to locate the context folder | | | Yes | v1.0.3 | Version to scope processing | | module: | No | module:Location Information` | Limit generation to a single module |
Application Folder Resolution
The application name is matched against root-level application folders:
- Strip any leading
_prefix from folder names (e.g.,1_hub_middleware→hub_middleware) - Match case-insensitively against the provided application name
- Accept snake_case, kebab-case, or title-case input (all match the same folder)
- If no match found, list available applications and stop
Auto-Resolved Paths
| File | Resolved Path | |------|---------------| | PRD.md | /context/PRD.md | | Module Models | /context/model/ | | HTML Mockups | /context/mockup/ | | Output (specification) | /context/specification/ |
Example Invocations
/specgen-spring-jpa-jtehtmx hub_middleware v1.0.3(all modules)/specgen-spring-jpa-jtehtmx hub_middleware v1.0.3 module:Location Information(one module)/specgen-spring-jpa-jtehtmx "Hub Middleware" v1.0.3
Version Filtering
When a version is provided, only include user stories, NFRs, and constraints from versions ` is provided:
- Only generate the
SPEC.mdfor that specific module - Other existing module spec files remain untouched
SPECIFICATION.md(root) gets a partial update — only that module's entry in the TOC
is added or updated; all other TOC entries are preserved as-is
Gathering Input
The specification is driven by six input sources that are read from the project's context files. The skill does NOT ask the user for database, authentication, scheduling, or messaging choices — it determines these automatically from the context.
Input 1: Application Name (from CLAUDE.md)
From CLAUDE.md (already loaded in context), locate the target application under the Custom Applications section. Extract:
- Application name: The section heading (e.g., "Hub Middleware", "HC Adapter")
- Application description: The description paragraph below the heading
- Dependencies: The "Depends on" list — this is the primary source for determining
optional components (see [Determining Optional Components](#determining-optional-components))
The application name is used to derive:
- Artifact ID: Kebab-case of the application name (e.g.,
hub-middleware) - Group ID:
com.bestinet.urp(project-level constant) - Base package:
com.bestinet.urp.(e.g.,com.bestinet.urp.hubmiddleware)
Input 2: User Stories (from PRD.md)
Read /context/PRD.md. This file contains all user stories organized by module. Extract:
- System modules: Modules under the
# System Moduleheading (e.g., User, Notification,
Activities, Audit Trail). These become system-level modules in the spec.
- Business modules: Modules under the
# Business Moduleheading (e.g., Location
Information, Corridor, Employer). These become business-level modules.
- User stories per module: Each
### User Storysection contains tagged items like
[USHM00108] As a user, I want to.... These define the functional requirements for each module's service interface and page controllers.
The user stories directly inform:
- Which CRUD operations each module's service must expose
- Which page controllers and JTE views are needed
- Which form fields and validation rules apply
Important: Items with strikethrough (~~text~~) are deprecated — do NOT include them as active requirements. Instead, list them in the "Removed / Replaced" subsection of the traceability table (see spec-template.md) so that developers can see what was removed and which version removed it. If a deprecated item has a replacement (e.g., USHM00015 replaced by USHM00222), note the replacement ID.
- Version tags per item: Each
### User Story,### Non Functional Requirement,
and ### Constraint section contains one or more version blocks formatted as [v1.0.x]. Items listed under each version tag belong to that version. The skill must track the version tag for each item (user story, NFR, constraint) and carry it through to the generated specification's traceability section. When a version block explicitly lists "Removed ... from previous version", record those removals in a "Removed / Replaced" subsection with the version that removed them and the replacement ID (if any).
Input 3: Non-Functional Requirements (from PRD.md)
Within the same PRD.md, each module has a ### Non Functional Requirement section with tagged items like [NFRHM0120]. These inform:
- Data storage strategies (e.g., "stored in JWT token", "stored in the database")
- Integration patterns (e.g., "API call to SSO service", "sent asynchronously")
- Performance constraints (e.g., "automatically deleted after 30 days")
- Security requirements (e.g., "require user to relogin")
NFRs should be mapped to specific technical decisions in the spec — for example, an NFR stating "stored in JWT token" confirms stateless auth, while "sent asynchronously" confirms event-driven processing.
Input 4: Constraints (from PRD.md)
Within the same PRD.md, each module has a ### Constraint section with tagged items like [CONSHM042]. These define hard boundaries that the spec must enforce:
- Field-level restrictions (e.g., "can only change name and phone number")
- Feature boundaries (e.g., "only 2 delivery channels supported")
- Scope limitations (e.g., "does not manage any user, permissions and roles")
Constraints are embedded directly into the relevant module blueprint — they inform service interface contracts, validation rules, and UI form configurations.
Input 5: Module Model (from model/ folder)
Read /context/model/MODEL.md first as the index, then read the individual module model files in each module subfolder.
MODEL.md provides:
- Summary table of all modules with collection counts and design decisions
- Links to each module's detailed model files
Per-module files (e.g., model/location-information/model.md):
- Complete document/entity field definitions with types and constraints
- Embedded vs. referenced relationships
- Collection/table names
- Index specifications
- Audit field patterns
Per-module schema (e.g., model/location-information/schemas.json):
- JSON schemas defining exact field types, required fields, and validation rules
Per-module diagram (e.g., model/location-information/document-model.mermaid):
- Visual representation of document structure and relationships
The module model directly maps to:
- MongoDB documents or JPA entities (field-for-field, not placeholder)
- Repository methods and query patterns
- MapStruct mapper definitions
- DTO structures matching the actual module fields
- Service interface method signatures
- Version tracking: The MODEL.md summary table includes a "Versions" column listing
which versions each module participates in (e.g., "1.0.0, 1.0.1, 1.0.3"). Per-module model.md files may also include version annotations on fields and indexes. The skill must carry these version tags into the generated specification.
Input 6: HTML Mockup Screens (from mockup/ folder)
Read /context/mockup/MOCKUP.html first as the index page, then read the HTML files organized by role in subfolders.
MOCKUP.html provides:
- Application identity (name, version, short name)
- Design tokens: fonts, colors, spacing from Tailwind config
- List of user roles and their screen sets
- Setup instructions for the mockup server
Role-specific subfolders (e.g., mockup/hub_administrator/content/):
- Individual HTML screens for each page in the application
- Screen layout: which components are used (tables, forms, cards, tabs, modals)
- Navigation structure from sidebar HTML files
- Data display patterns (list pages, detail pages, create/edit forms)
IMPORTANT — Role folders inform access control, NOT URL paths. The role-specific folder structure (e.g., mockup/hub_administrator/content/corridor.html) determines:
- Which role can access the page →
@PreAuthorize("hasRole('HUB_ADMINISTRATOR')") - Which sidebar navigation items appear for each role
It does NOT determine the URL path. The URL path is always module-based:
@RequestMapping("/corridor")— NOT@RequestMapping("/hub_administrator/corridor")- Fragment URL:
@RequestMapping("/corridor/fragments")— NOT@RequestMapping("/api/content/hub_administrator/corridor")
Shared partials (e.g., mockup/partials/):
header.html— Header bar layout and elementsfooter.html— Footer layoutsidebar-.html— Per-role navigation menusshell.html— Page shell/wrapper structure
The mockup screens directly map to:
- JTE page templates (one per HTML screen)
- JTE fragment templates (for htmx partial updates)
- Page controller endpoints (one per screen)
- View model classes (with fields matching the data shown in each screen)
- Sidebar navigation items per role
- Form field layouts and validation display
- Design tokens for Tailwind configuration (colors, fonts from MOCKUP.html)
- Version tracking: The MOCKUP.html index page shows a version tag on each screen
card (e.g., v1.0.0, v1.0.3). Individual mockup screens may include version annotations. The skill must associate each mockup screen with its version and carry this through to the generated specification.
PRD.md Extended Sections
Before determining optional components, check PRD.md for the following extended sections and extract their content for use throughout specification generation:
Architecture Principle Extraction
If PRD.md contains an # Architecture Principle section, read it and extract architectural patterns as a structured context object. These patterns serve as primary signals for optional component determination and specification content:
| Pattern to Extract | How It Infl
…
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: rashidee
- Source: rashidee/co2-skills
- License: MIT
- Homepage: https://compound-context.com/
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.