Maven Full Runner

• Analyzed: May 11, 2026, 4:52 AM
• Findings: 1
• Version: 1.1.0
• Hash: bf5648565321e0c03ebf365f9afc0ab50c2da8b14e235222c3b72c52332fe57e
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is a transparent wrapper for the `mvn` command, designed for full passthrough of arguments as stated in `SKILL.md` and `README.md`. The `scripts/mvn.mjs` implementation correctly uses `spawn` with `shell: false`, which prevents shell injection vulnerabilities through the wrapper itself. There is no evidence of data exfiltration, malicious execution beyond the intended `mvn` command, persistence mechanisms, or prompt injection attempts in `SKILL.md` aimed at subverting the agent's behavior. The skill's functionality aligns with its stated purpose without introducing hidden malicious capabilities.