Java Switch

ReviewAudited by ClawScan on May 10, 2026.

Overview

This skill appears to do what it claims—install and switch Java on macOS—but it can run installer commands and permanently edit your shell profile.

This skill is reasonable for macOS Java management, but treat it like a local setup script: run it only when you intend to install or switch Java, review Homebrew prompts, and check ~/.zshrc afterward because it permanently changes your shell environment.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Running the skill on a Mac without Homebrew can execute external installation code and make local system/package-manager changes.

Why it was flagged

If Homebrew is missing, the script downloads and executes the Homebrew installer from GitHub HEAD. This is a common and disclosed setup path for Homebrew, but it is still remote, unpinned installer execution.

Skill content

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

Recommendation

Only run this if you trust Homebrew and your network path; consider installing Homebrew manually first or reviewing the installer command before allowing the skill to proceed.

Low

#ASI02: Tool Misuse and Exploitation

What this means

The skill may install software on your machine once invoked, which can take time, use network access, and change your development environment.

Why it was flagged

The script invokes the local package manager with a user-provided Java version. This is central to the skill's purpose and the argument is quoted, but it still performs package installation based on the requested version.

Skill content

brew install "openjdk@$VERSION"

Recommendation

Use a normal Java version such as 8, 11, 17, or 21, and review any Homebrew prompts before continuing.

Medium

#ASI10: Rogue Agents

What this means

Your default Java version and PATH can change permanently for new terminal windows, and existing shell configuration may be altered.

Why it was flagged

The script persistently modifies the user's zsh startup file, backs it up, comments an existing JAVA_HOME line, appends new Java settings, and reloads the profile. This persistence is disclosed and purpose-aligned, but it affects future shells.

Skill content

cp ~/.zshrc ~/.zshrc.backup.$(date +%Y%m%d%H%M%S)
sed -i '' 's/^export JAVA_HOME=\$(\/usr\/libexec\/java_home/# &/' ~/.zshrc 2>/dev/null || true
...
echo 'export JAVA_HOME=$(/usr/libexec/java_home -v '"$VERSION"')' >> ~/.zshrc
source ~/.zshrc

Recommendation

Back up or review ~/.zshrc before running, and verify the generated JAVA_HOME/PATH lines afterward if you maintain custom shell configuration.