maven-code-search
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the
maven-decoder-mcppackage, which is intended to be run viauvx. As this is the core component provided by the vendor for the skill's functionality, it is considered a legitimate dependency. - [SAFE]: The instructions are well-structured and prioritize safe behavior, such as grounding responses in tool results, preferring source files over decompiled code, and advising against posting large amounts of code in the chat.
- [PROMPT_INJECTION]: The skill operates by reading third-party code from the user's local Maven repository (
~/.m2). While this presents a surface for indirect prompt injection (where malicious instructions could be embedded in the code being inspected), the skill does not include any logic that would facilitate such an attack beyond its intended function as a code analysis tool.
Audit Metadata