When setting node['cdap']['skip_prerequisites'] = 'true', I expect that Java will not be installed. However, since https://github.com/caskdata/cdap_cookbook/pull/185 was merged, we run the security recipe unconditionally. This used to be an independent recipe, so it always included Java. Instead, security should simply include default, like the other recipes.
This has been fixed and will be in the next CDAP cookbook patch release.