Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only Maven configuration skill with a few copy-paste examples that need care, but no hidden execution, persistence, or data access was found.
Before copying examples from this skill, review any Maven configuration that runs external commands, changes release/version state, or embeds developer identity/build timestamps. Use the exec plugin only with trusted scripts in trusted repositories, and remove Built-By or Build-Time entries if privacy or reproducible builds matter.
The skill includes an exec-maven-plugin example that runs a shell script via bash during generate-sources. In a documentation skill intended for broad Maven plugin configuration guidance, this can normalize arbitrary command execution inside builds and may be copied into real projects without understanding that it grants code execution during CI or local builds.
The JAR manifest example embeds ${user.name} and build timestamp metadata without warning about privacy or reproducibility implications. This can leak developer identity or environment details in distributed artifacts and can also undermine reproducible builds.
The documentation shows shell execution through exec-maven-plugin without an explicit safety warning. Even as an example, this can encourage users to insert unchecked scripts into Maven lifecycles, increasing the risk of executing unsafe commands in developer workstations or CI pipelines.
