Java Maven Common
ReviewAudited by ClawScan on May 10, 2026.
Overview
The skill mostly matches its Maven project-ingest purpose, but its helper script can recursively delete any path supplied as the work directory before cloning.
Review before installing or using. The skill is coherent for Maven ZIP/GitLab intake, but run it only with a disposable temp work directory because git mode deletes the existing work path. Also ensure GitLab access is intentional and avoid credential-bearing repository URLs.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If the agent or user passes the wrong work path, the skill could delete local files or directories unrelated to the Maven review.
The script resolves the caller-supplied --work path and, in git mode, recursively removes it if it already exists. Although the documentation says the work directory should be under temp, the code does not enforce that containment.
work = Path(args.work).resolve() ... if out_dir.exists():
shutil.rmtree(out_dir)Only run it with a newly created temp subdirectory, and prefer adding code guards that refuse root, home, project, or non-temp paths before calling shutil.rmtree.
The skill may access private repositories available to the user's SSH credentials.
The Git workflow is expected for this skill, but it uses the user's GitLab/SSH authorization to access a repository.
GitLab clone after SSH authorization ... Confirm SSH authorization has been granted by the user
Use it only for repositories you intend to review, and avoid putting tokens or passwords directly in repository URLs.
Git mode will fail without git installed, and repository access will use the local git/SSH configuration.
Git is a purpose-aligned dependency for cloning, but the registry metadata says there are no required binaries, so users may not realize this external command is required.
subprocess.run(["git", "clone", repo_url, str(out_dir)], check=True)
Declare git as a required binary for GitLab mode and make clear that cloning uses local git configuration.