Maven Full Runner

v1.1.0

Run Maven commands with full argument passthrough, optionally specifying the working directory, using a Node.js wrapper for safer execution.

0· 330·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
The skill's name/description match its code and instructions: it is a passthrough wrapper that only consumes --dir and forwards all other arguments to mvn. However, the registry metadata lists no required binaries while the SKILL.md and the script both state that node and mvn must be present in PATH — that metadata mismatch is inconsistent and should be corrected.
Instruction Scope
SKILL.md and the script limit the wrapper to parsing --dir and forwarding all other args unchanged. The script only checks that the target directory exists and then spawns 'mvn' with shell:false and stdio inherited. This is consistent with the stated purpose. Important security note: because all Maven goals/arguments are forwarded, running this skill against untrusted repositories or build files can execute arbitrary code (via Maven plugins, lifecycle hooks, downloaded artifacts), and Maven itself may perform network activity to fetch dependencies — these are expected behaviors for a build runner but are risks the user should understand.
Install Mechanism
No install spec; the skill is instruction-only with an included script file. Nothing is downloaded or executed during install and no external install URLs are used.
Credentials
The skill requests no environment variables or credentials and the script does not read secrets or unrelated config paths. It relies only on system binaries (node and mvn), which is proportionate to a Maven wrapper.
Persistence & Privilege
The skill does not request permanent presence (always:false), does not modify other skills’ configuration, and does not require elevated privileges. Autonomous invocation is allowed by default (platform normal) but not a special privilege here.
Assessment
This skill is a simple Node-based passthrough for the local 'mvn' tool and appears to do only that. Before installing: (1) confirm the registry metadata or UI documents that Node.js and Maven are required (the SKILL.md does state these are needed even though the metadata lists none); (2) be careful not to run this against untrusted projects — Maven builds and plugins can run arbitrary code and download dependencies from the network; (3) inspect the included scripts (scripts/mvn.mjs) yourself if you want to verify there are no modifications. If you only need to run safe, known builds in trusted repositories, this skill is appropriate.

Like a lobster shell, security has layers — review code before you run it.

latestvk9747nrv0cf3ry3w7h3eak2qqh81z8v7

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Comments