Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
maven-central-publish
v1.0.0Provides a standardized Maven workflow to publish Java artifacts to Maven Central using GPG signing and the modern Central Portal plugin.
⭐ 0· 671·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the content: instructions, pom/templates, and advice all relate to publishing artifacts to Maven Central using GPG signing and the central-publishing plugin. Declared required binaries (maven, gpg) appear in a metadata block and the README references openjdk as well — all appropriate for the stated purpose.
Instruction Scope
SKILL.md stays on-topic (install maven/gnupg/openjdk, configure GPG loopback, populate ~/.m2/settings.xml, add plugins to pom, run mvn deploy). It does not instruct reading unrelated host files or exfiltrating data. However, it recommends storing sensitive credentials (user token and GPG passphrase) directly in ~/.m2/settings.xml which is a risky practice and should be avoided or replaced by secure alternatives.
Install Mechanism
This is an instruction-only skill with no install spec and no code files to execute — lowest install risk. The included apt-get snippets are examples (not automated installers) and reference common package sources. No downloads from untrusted external URLs are present.
Credentials
The skill requests no environment variables or external credentials in its metadata, which is proportionate. The instructions do, however, ask the user to place the Central Portal user token and the GPG passphrase in ~/.m2/settings.xml (plaintext). That is proportional to publishing but security-sensitive — storing secrets in plain files increases risk and better alternatives exist (Maven settings encryption, CI secret stores, gpg-agent, or prompting via secure pinentry).
Persistence & Privilege
Skill is not always-enabled, has normal user-invocable/autonomous settings, and does not request modification of other skills or system-wide agent settings. No privilege escalation or persistent background components are requested.
Assessment
This skill appears to be exactly a Maven Central publish guide with matching templates — it is internally coherent. Before using it, avoid copying secrets verbatim into ~/.m2/settings.xml: do not store GPG passphrases or user tokens in plaintext. Prefer Maven settings encryption (settings-security.xml), CI secret storage, or using gpg-agent/loopback pinentry securely so the passphrase is not stored on disk. Review the templates and replace placeholder tokens with secret references managed by your CI or secret manager. Also be aware the example apt-get commands need root privileges and are just suggestions — run them only on machines you control. If you need higher assurance, request the skill author to provide documentation showing secure, non-plaintext handling of credentials (or to switch to recommending encrypted settings or environment-injected secrets).Like a lobster shell, security has layers — review code before you run it.
latestvk974h3wzjxg56qg1745n3zkef1815rp9
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📦 Clawdis