maven

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The list mixes official Maven/Spring/GitHub sources with multiple non-official or internal-looking repository URLs (corporate-, example-, fast-repo.com, secure-repo.com, artifactory.example.com, nexus.example.com) and an explicit binary download hosted on a non-official domain — these non-official repositories and mirrors can be used to distribute tampered or malicious artifacts if they are not trusted and verified.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The Maven Wrapper properties in references/maven-wrapper.md specify distributionUrl (https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.5/apache-maven-3.9.5-bin.zip) and wrapperUrl (https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.2.0/maven-wrapper-3.2.0.jar), which are fetched at runtime by ./mvnw and download/execute remote binaries/jars—i.e., remote code executed during skill use.