Maven POM Validator

Validate and lint Maven pom.xml files for structure, dependencies, plugins, and best practices. Use when asked to lint, validate, check, or audit pom.xml fil...

Security Scan

The skill's requirements, instructions, and included code are consistent with a local Maven pom.xml linter: it reads and analyzes pom.xml files, uses only the Python stdlib, and requests no unrelated credentials or installs.

Purpose & Capability

Name/description match what is present: the SKILL.md documents lint/validate/dependencies/plugins commands and the repository includes a Python script that performs those checks. No unrelated binaries, services, or credentials are requested.

Instruction Scope

Runtime instructions tell the agent to run the included Python script against a specified pom.xml (e.g., python3 scripts/maven_pom_validator.py lint pom.xml). The script operates on local POM files, inspects XML structure and text, and emits findings; it does not reference external endpoints, other system config, or unrelated environment variables.

Install Mechanism

No install spec is provided (instruction-only). The included script is pure-Python stdlib and does not download or install external code. This is low-risk and proportionate for the stated purpose.

Credentials

No environment variables, credentials, or config paths are required. The checks operate on the POM contents and local filesystem paths mentioned in the POM (the script flags hardcoded paths in plugin configuration), which is expected for a linter.

Persistence & Privilege

always is false and the skill does not request persistent privileges or modify other skill/system configurations. Autonomous invocation is allowed by the platform default but is not combined with broad credential access or other red flags.

Assessment

This skill appears to do what it says: it runs a local Python script to lint pom.xml files and does not request credentials or network access. Before installing or running it, you may want to: 1) inspect scripts/maven_pom_validator.py yourself (it's included) to confirm you are comfortable executing it; 2) run it on sample files in a sandbox or non-production environment; and 3) note that it will read any pom.xml you point it at and will flag hardcoded absolute paths found inside plugin configurations. There are no obvious incoherencies or unexpected external contacts in the provided files.

Validate and lint Maven pom.xml files for structural correctness, dependency hygiene, plugin configuration, and best practices.

Commands

lint — Full lint pass (all 20+ rules)

python3 scripts/maven_pom_validator.py lint pom.xml
python3 scripts/maven_pom_validator.py lint pom.xml --strict
python3 scripts/maven_pom_validator.py lint pom.xml --format json
python3 scripts/maven_pom_validator.py lint pom.xml --format markdown

dependencies — Audit dependency declarations

python3 scripts/maven_pom_validator.py dependencies pom.xml
python3 scripts/maven_pom_validator.py dependencies pom.xml --format json

plugins — Audit plugin declarations

python3 scripts/maven_pom_validator.py plugins pom.xml
python3 scripts/maven_pom_validator.py plugins pom.xml --format markdown

validate — Quick structural validation only

python3 scripts/maven_pom_validator.py validate pom.xml
python3 scripts/maven_pom_validator.py validate pom.xml --strict

Flags

Flag	Description
--strict	Exit code 1 on warnings (CI mode)
--format text	Human-readable output (default)
--format json	Machine-readable JSON
--format markdown	Markdown report

Lint Rules

Structure (5 rules)

1. Valid XML — file must be well-formed XML
2. Required elements — groupId, artifactId, version, modelVersion must be present
3. modelVersion must be "4.0.0"
4. groupId format — must follow reverse-domain convention (e.g. com.example)
5. packaging value must be valid (jar, war, pom, ear, rar, maven-plugin)

Dependencies (6 rules)

6. No duplicate dependencies (same groupId:artifactId)
7. No SNAPSHOT versions in release POMs
8. Version must be defined (not missing)
9. No wildcard/range versions (LATEST, RELEASE, [1.0,))
10. Scope must be valid (compile, test, provided, runtime, system, import)
11. system-scoped deps must have <systemPath>

Plugins (5 rules)

12. Plugin versions must be pinned
13. No duplicate plugins (same groupId:artifactId)
14. Plugin groupId should be specified
15. Known deprecated plugins flagged
16. Configuration elements checked for common issues

Best Practices (6 rules)

17. Properties used for version management (DRY check)
18. dependencyManagement used in parent POMs
19. UTF-8 encoding specified (project.build.sourceEncoding)
20. Java source/target version set (maven.compiler.source/target or release)
21. No hardcoded absolute paths in configuration
22. SCM section present

Exit Codes

Code	Meaning
0	No errors (warnings OK unless --strict)
1	Errors found (or warnings with --strict)
2	Script usage error