Security audit
Security checks for vulnerabilities and agentic risk
This Java toolkit does not show malicious behavior, but it is routed far too broadly for a skill that can run commands and write files.
Install only if you intend to use it for Java repository scanning, ruleset management, JVM/GC review, and build or coverage gates. Treat command execution and file writes as requiring explicit user direction, especially if the current task is generic reporting, planning, or non-Java data analysis.
The trigger condition is materially mismatched to the skill's stated Java scanning and JVM tuning purpose, encouraging invocation for generic data analysis and reporting tasks outside its intended scope. In an agent environment with read/exec/write tools, overbroad routing can cause the skill to run in inappropriate contexts and perform filesystem or command actions on unrelated tasks.
An overly broad trigger increases the chance that the agent selects this skill for requests far outside Java analysis, despite the skill advertising exec/write capability and command-driven workflows. Mis-selection is dangerous because it can lead to unintended command execution, file modification, or misleading outputs in contexts where the user did not ask for repository scanning or build actions.
The manifest description includes vague guidance such as project management, task planning, and team collaboration, which overlaps with common non-code requests and can broaden when the skill is auto-invoked. In combination with powerful tools, this scope creep can cause an agent to apply code-scanning behavior or command execution in situations unrelated to Java engineering tasks.
No suspicious patterns detected.
