maven-central-publish

• Analyzed: May 14, 2026, 4:02 AM
• Findings: 1
• Version: 1.0.0
• Hash: dd08a8a710afd2833d74c9e71697fa15f44ccbb5e00a1df220365181a3527e6a
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is designed for a legitimate purpose (publishing to Maven Central) and uses standard tools and configurations. However, it instructs the agent to store sensitive credentials (Maven Central user token, GPG passphrase) in `~/.m2/settings.xml` (as shown in `SKILL.md` and `templates/settings.xml`). While a common practice for Maven, this represents a significant security risk if the file is not properly secured. Additionally, the `SKILL.md` instructs the agent to execute `gpg --keyserver keyserver.ubuntu.com --send-keys <KEY_ID>`, which involves an outbound network connection to publish a GPG public key. These actions, while plausibly needed for the stated purpose, involve handling and transmitting sensitive information, classifying the skill as suspicious due to these high-risk capabilities without clear malicious intent.