Java Maven Common

• Analyzed: Apr 14, 2026, 9:26 AM
• Findings: 1
• Version: 1.0.0
• Hash: d6712166753f7885e2dd7a08550b773f17e3fe58410c45cb04a21de1b1951793
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill contains security vulnerabilities in 'scripts/prepare_java_maven_project.py' that could be exploited if processing untrusted input. Specifically, it uses 'zipfile.extractall()', which is vulnerable to ZipSlip (directory traversal), and passes the repository URL directly to 'git clone' without sanitization, potentially allowing for argument injection. While these are high-risk vulnerabilities, they appear to be unintentional flaws rather than intentional malware.