Java Maven Secondary Analysis

• Risk level: Low
• Analyzed: Apr 14, 2026, 8:30 AM
• Findings: 0
• Version: 1.0.0

Overview

The skill's code and instructions are consistent with its stated purpose (local static scanning of a prepared Java Maven tree) and do not request unrelated credentials or perform network/exfiltration actions.

This skill appears to only run a local static scan and generate a markdown report; it does not exfiltrate data or request credentials itself. Before installing or invoking it, check the following: (1) the external preparer referenced ('java-maven-common') is trustworthy because preparing ZIPs or cloning GitLab URLs may require SSH keys or tokens; (2) confirm you are comfortable the agent/environment that runs the skill has appropriate access to the repository (avoid granting broad SSH keys to untrusted code); (3) note reports are written to disk (suggested 'business/' directory) — verify workspace permissions and storage location; (4) if you need end-to-end behavior (feed a raw GitLab URL), inspect or provide the preparer implementation to ensure no unexpected network/exfiltration occurs.