ClawHub
Back to skill

Security audit

maven-central-publish

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Maven Central publishing guide, but it directs users to persist publishing tokens and a GPG passphrase in plaintext without adequate safety guidance.

Review before installing. The publishing workflow itself is normal, but do not store real Central Portal tokens or GPG passphrases in plaintext templates or commit them. Use Maven credential encryption, CI secret injection, restrictive file permissions, and a protected signing setup before following the release steps.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
templates/settings.xml:15
Finding

Plaintext Storage of Maven Central Credentials and GPG Passphrase

Content
View full analysis
central REPLACE_WITH_USER_TOKEN_NAME REPLACE_WITH_USER_TOKEN_PASS ``` `templates/settings.xml:27-34`: ```xml release false gpg REPLACE_WITH_PASSPHRASE ``` The same workflow is presented in `SKILL.md:55-74`: ```xml central USER_TOKEN_USERNAME USER_TOKEN_PASSWORD release false gpg YOUR_GPG_PASSPHRASE ``` ### Technical Analysis The supplied template and documentation instruct users to replace placeholders with a real Maven Central Portal token username, token password, and GPG private-key passphrase in Maven's `settings.xml`. Maven settings files are ordinary XML files, so these values remain readable plaintext unless Maven credential encryption or another secret-management mechanism is used. The project does not instruct users to encrypt the server password, inject secrets temporarily from a secure CI secret provider, restrict ...[truncated 2051 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · templates/settings.xml (reported line 6)May include surrounding context.

text
xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0 http://maven.apache.org/xsd/settings-1.0.0.xsd">
  
  <mirrors>
    <!-- Optional: Aliyun Mirror for faster downloads in China -->
    <mirror>
      <id>aliyunmaven</id>
      <mirrorOf>central</mirrorOf>

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md
gpg --gen-key

# 2. Configure Loopback (Prevent UI prompts)
mkdir -p ~/.gnupg
echo "allow-loopback-pinentry" >> ~/.gnupg/gpg-agent.conf
echo "pinentry-mode loopback" >> ~/.gnupg/gpg.conf
gpg-connect-agent reloadagent /bye

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill instructs users to place the Central Portal token username/password and the GPG passphrase directly into ~/.m2/settings.xml in plaintext, without warning about secret exposure or safer alternatives. This increases the risk of credential theft from disk, backups, shared home directories, CI logs, or accidental check-in, and the GPG passphrase can enable unauthorized artifact signing if the key is also accessible.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.