Install
$ agentstack add skill-vaquarkhan-fullstack-development-agent-skills-multi-module-maven ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Multi Module Maven
Use When
- Structuring multi-module Maven Spring Boot monorepos
- Spring Boot code generation or refactor where agent defaults would be wrong
Workflow
- Confirm the change matches this skill's domain triggers before coding.
- Follow the domain guide conventions and gotchas below — not generic Spring Boot defaults.
- Apply project-specific response envelopes, DTO boundaries, and dependency injection rules.
- Validate with targeted tests (slice, integration, or contract as appropriate).
- Capture evidence before merge: tests, migration notes, or observability proof.
Required Checks
- Constructor injection used; no @Autowired field injection on new code
- Controllers return DTOs/envelopes — never raw JPA entities
- Business logic stays in @Service layer, not controllers or repositories
- Error handling uses project-standard envelope or RFC 9457 ProblemDetail
Domain Guide
Typical Structure
my-app/
├── pom.xml ← Parent POM (packaging = pom)
├── my-app-domain/ ← Pure Java domain — no Spring
│ └── pom.xml
├── my-app-application/ ← Use cases — depends on domain
│ └── pom.xml
├── my-app-infrastructure/ ← JPA, Redis, HTTP clients
│ └── pom.xml
└── my-app-web/ ← Spring Boot app, REST — depends on all above
└── pom.xml
Parent POM
com.example
my-app
1.0.0-SNAPSHOT
pom
my-app-domain
my-app-application
my-app-infrastructure
my-app-web
org.springframework.boot
spring-boot-starter-parent
3.3.0
21
1.6.0
1.19.8
com.example
my-app-domain
${project.version}
com.example
my-app-application
${project.version}
org.mapstruct
mapstruct
${mapstruct.version}
org.apache.maven.plugins
maven-compiler-plugin
${java.version}
${java.version}
org.projectlombok
lombok
org.mapstruct
mapstruct-processor
${mapstruct.version}
Child Module POM (domain — no Spring)
com.example
my-app
1.0.0-SNAPSHOT
my-app-domain
org.projectlombok
lombok
true
Child Module POM (web — the runnable app)
...
my-app-web
com.example
my-app-application
com.example
my-app-infrastructure
org.springframework.boot
spring-boot-starter-web
org.springframework.boot
spring-boot-maven-plugin
Dependency Rules
| Module | Can depend on | Cannot depend on | |--------|---------------|------------------| | domain | Nothing | Everything | | application | domain | infrastructure, web | | infrastructure | domain, application | web | | web | All modules | — |
Gotchas
- Agent puts
spring-boot-maven-pluginin parent POM — only in the runnable module - Agent adds `
in parent instead of` — adds to all modules' classpath - Agent creates circular dependencies between modules — enforce the dependency direction above
- Agent imports Spring in
domainmodule — domain must be framework-free - Agent uses
${project.version}for inter-module versions — correct, but update parent version to update all
Examples And Templates
See \examples/\ for side-by-side good vs bad patterns agents commonly get wrong. See \ emplates/\ for copy-paste starters aligned with this skill.
Decision Framework
- Prefer Spring Boot 3.x and Spring AI 1.0 GA artifact coordinates — reject pre-GA dead names.
- Use constructor injection and immutable dependencies by default.
- Keep domain content in services; controllers are HTTP adapters only.
- Externalize prompts, API keys, and migration scripts — never hardcode secrets.
Common Rationalizations And Rebuttals
- "@Autowired fields are fine for prototypes." -> Field injection hides dependencies and breaks testability; use constructor injection.
- "The agent knows Spring Boot." -> Agents default to outdated patterns; follow this skill's gotchas and GA coordinates.
- "We can skip Flyway for this column." -> Manual DDL drifts from environments; use versioned migrations.
Evidence Pack
- Test output for changed endpoints, services, or migrations
- Diff showing DTO boundaries and no entity leakage in API layer
- Dependency or coordinate list confirming GA artifact names
- Observability or security checklist for auth/AI changes
Exit Criteria
- Generated code matches project layering and naming conventions
- No pre-GA Spring AI or MCP artifact names in pom/build files
- Tests pass for happy path and at least one failure/edge case
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: vaquarkhan
- Source: vaquarkhan/Fullstack-development-agent-skills
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.