Skills java-maven-helper
📦
java-maven-helper
Content revision r1 Critical ⚙️ External commands🌐 Network access📁 Filesystem access
Configure Java Maven Builds
Maven projects often fail because dependencies, plugins, and profiles are hard to align. This skill provides focused guidance for setup, troubleshooting, testing, and CI configuration.
Supports: Claude Codex Code(CC)
Do not auto-install this skill.
The canonical policy requires operator review before any installation action.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "java-maven-helper" from https://skillstore.io/skills/curiouslearner-java-maven-helper.md and its manifest at https://skillstore.io/api/skills/curiouslearner-java-maven-helper/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "java-maven-helper". A developer asks how to add JUnit 5 to a Maven project.
Expected outcome:
- Recommends JUnit Jupiter for tests.
- Explains test scope and Surefire configuration.
- Suggests running unit tests before packaging.
Using "java-maven-helper". A maintainer reports conflicting Guava versions in a Maven build.
Expected outcome:
- Suggests inspecting the dependency tree.
- Identifies dependencyManagement as the control point.
- Advises excluding unnecessary transitive dependencies.
Using "java-maven-helper". A team wants a GitHub Actions Maven pipeline.
Expected outcome:
- Describes checkout, Java setup, cache, test, and package steps.
- Notes artifact publishing considerations.
- Recommends keeping secrets outside the workflow file.
Security Audit
Criticalv8 • 7/5/2026 Open versioned report
Most static findings are false positives from Markdown fences and placeholder Maven URLs. Confirmed issues involve destructive cleanup commands, a hidden home configuration overwrite, and a plaintext Maven server password example. No evidence found for prompt injection or data exfiltration intent.
1
Files scanned
1,214
Lines analyzed
6
Review items
0
False positives ignored
Confirmed security concerns (3)
Critical
Recursive delete on root/home
rm -rf ~/.m2/repository/com/example/problematic-artifact
The example uses rm -rf under ~/.m2, which can delete local Maven cache content if copied or generalized. It is destructive home-directory guidance.
Critical
Recursive delete on root/home
rm -rf ~/.m2/repository
The troubleshooting example recommends rm -rf ~/.m2/repository, recursively deleting the user's whole local Maven repository. This is destructive hidden-home file guidance.
Medium
Plaintext Maven Server Credential Example
The settings.xml example includes a deployment username and literal password value. Users may copy this pattern into Maven configuration.
The sample settings.xml contains a server username and password element with a literal password. It is documentation, not active exfiltration.
Capability review items (6)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Critical
Hidden file in home directory
rm -rf ~/.m2/repository
The troubleshooting example recommends rm -rf ~/.m2/repository, recursively deleting the user's whole local Maven repository. This is destructive hidden-home file guidance.
Critical
Hidden file access
rm -rf ~/.m2/repository
The troubleshooting example recommends rm -rf ~/.m2/repository, recursively deleting the user's whole local Maven repository. This is destructive hidden-home file guidance.
High
Hidden file in home directory
rm -rf ~/.m2/repository/com/example/problematic-artifact
The example uses rm -rf under ~/.m2, which can delete local Maven cache content if copied or generalized. It is destructive home-directory guidance.
High
Hidden file in home directory
echo "MAVEN_OPTS='-Xmx2048m'" > ~/.mavenrc
The example writes to ~/.mavenrc with >, overwriting a hidden user configuration file and creating persistent Maven settings. The goal is legitimate but risky without consent.
High
Hidden file access
rm -rf ~/.m2/repository/com/example/problematic-artifact
The example uses rm -rf under ~/.m2, which can delete local Maven cache content if copied or generalized. It is destructive home-directory guidance.
High
Hidden file access
echo "MAVEN_OPTS='-Xmx2048m'" > ~/.mavenrc
The example writes to ~/.mavenrc with >, overwriting a hidden user configuration file and creating persistent Maven settings. The goal is legitimate but risky without consent.
Risk Factors
⚙️ External commands (75)
SKILL.md:47-72 SKILL.md:72-75 SKILL.md:75-108 SKILL.md:108-112 SKILL.md:112-119 SKILL.md:119-124 SKILL.md:124-328 SKILL.md:328-331 SKILL.md:331-383 SKILL.md:383-388 SKILL.md:388-418 SKILL.md:418-421 SKILL.md:421-436 SKILL.md:436-438 SKILL.md:438-478 SKILL.md:478-480 SKILL.md:480-505 SKILL.md:505-510 SKILL.md:510-516 SKILL.md:516-518 SKILL.md:518-524 SKILL.md:524-527 SKILL.md:527-548 SKILL.md:548-551 SKILL.md:551-587 SKILL.md:587-590 SKILL.md:590-602 SKILL.md:602-609 SKILL.md:609-624 SKILL.md:624-627 SKILL.md:627-640 SKILL.md:640-643 SKILL.md:643-657 SKILL.md:657-660 SKILL.md:660-674 SKILL.md:674-677 SKILL.md:677-702 SKILL.md:702-705 SKILL.md:705-726 SKILL.md:726-729 SKILL.md:729-738 SKILL.md:738-740 SKILL.md:740-745 SKILL.md:745-750 SKILL.md:750-807 SKILL.md:807-809 SKILL.md:809-821 SKILL.md:821-826 SKILL.md:826-841 SKILL.md:841-843 SKILL.md:843-855 SKILL.md:855-858 SKILL.md:858-866 SKILL.md:866-868 SKILL.md:868-878 SKILL.md:878-881 SKILL.md:881-890 SKILL.md:890-893 SKILL.md:893-902 SKILL.md:902-905 SKILL.md:905-918 SKILL.md:918-923 SKILL.md:923-971 SKILL.md:971-976 SKILL.md:976-999 SKILL.md:999-1002 SKILL.md:1002-1042 SKILL.md:1042-1044 SKILL.md:1044-1049 SKILL.md:1049-1054 SKILL.md:1054-1086 SKILL.md:1086-1089 SKILL.md:1089-1128 SKILL.md:1128-1170 SKILL.md:1170-1200
🌐 Network access (21)
Detected Patterns
Recursive delete on root/home×2
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/curiouslearner-java-maven-helper/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/curiouslearner-java-maven-helper?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/curiouslearner-java-maven-helper?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/curiouslearner-java-maven-helper/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/curiouslearner-java-maven-helper.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
CuriousLearner. (2026). java-maven-helper security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/curiouslearner-java-maven-helper/audits/8BibTeX citation
@techreport{curiouslearner-curiouslearner-java-maven-helper-2026,
author = {CuriousLearner},
title = {java-maven-helper security audit report (audit version 8)},
institution = {Skillstore},
year = {2026},
number = {8},
url = {https://skillstore.io/skills/curiouslearner-java-maven-helper/audits/8},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "java-maven-helper security audit report (audit version 8)"
version: "unspecified"
type: report
authors:
- name: "CuriousLearner"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/curiouslearner-java-maven-helper/audits/8"
identifiers:
- type: other
value: "skillstore:curiouslearner-java-maven-helper:audit:8"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
85
Content
71
Community
70
Spec Compliance
What You Can Build
Start a Maven Project
Create a standard Java project layout and choose basic Maven coordinates.
Resolve Build Failures
Diagnose dependency conflicts, plugin errors, and repository resolution problems.
Prepare CI Builds
Plan Maven test, package, cache, and artifact steps for CI pipelines.
Try These Prompts
Create a Project
Help me create a basic Maven Java project. Ask for groupId, artifactId, Java version, and package type.
Add Dependencies
Review my dependency needs and recommend Maven dependencies, scopes, and version management choices.
Fix Build Errors
Analyze this Maven build failure. Explain the likely cause and give safe, ordered troubleshooting steps.
Design Build Architecture
Design a multi-module Maven build with profiles, testing, packaging, dependency management, and CI caching guidance.
Best Practices
- Pin Java, plugin, and dependency versions through properties or dependencyManagement.
- Run dependency analysis before changing transitive exclusions.
- Prefer project-local configuration before changing user home Maven files.
Avoid
- Copying build snippets without checking versions and scopes.
- Deleting the whole local Maven repository as a first troubleshooting step.
- Storing repository passwords directly in shared Maven settings examples.
Frequently Asked Questions
Can this skill create a Maven project?
It can guide project creation and provide Maven command examples. It does not run commands automatically.
Does it help with dependency conflicts?
Yes. It explains dependency trees, exclusions, scopes, and dependencyManagement usage.
Can it configure Maven plugins?
Yes. It covers compiler, test, packaging, shade, assembly, and exec plugin patterns.
Does it support CI pipelines?
Yes. It includes GitHub Actions and GitLab CI build patterns for Maven projects.
Will it scan dependencies for vulnerabilities?
No. Use a dedicated dependency security scanner for vulnerability detection.
Is it safe to copy every command?
No. Review commands that delete files or change user home configuration before running them.
Developer Details
Author
CuriousLearnerLicense
MIT
Skillstore revision
r1
Version notice
The author did not declare a version.
Ref
02f077c174c5335e2f5d02ca15e77b70d9543e58
Maintenance freshness
7/18/2026
Usage
15 downloads · 278 views
File structure
📄 SKILL.md