maven-indexer

SUSPICIOUS. The stated purpose is coherent, but the install path is not: the skill directs installation of an npm CLI that could not be verified as the official Apache Maven Indexer and whose interface does not match Apache’s documented CLI. Because the core capability depends on an unverifiable third-party executable, the supply-chain risk is high even without explicit credential theft or exfiltration behavior.