← Back to Skills Marketplace
760
Downloads
0
Stars
1
Active Installs
1
Versions
Install in OpenClaw
/install maven-central-publish
Description
Provides a standardized Maven workflow to publish Java artifacts to Maven Central using GPG signing and the modern Central Portal plugin.
Usage Guidance
This skill appears to be exactly a Maven Central publish guide with matching templates — it is internally coherent. Before using it, avoid copying secrets verbatim into ~/.m2/settings.xml: do not store GPG passphrases or user tokens in plaintext. Prefer Maven settings encryption (settings-security.xml), CI secret storage, or using gpg-agent/loopback pinentry securely so the passphrase is not stored on disk. Review the templates and replace placeholder tokens with secret references managed by your CI or secret manager. Also be aware the example apt-get commands need root privileges and are just suggestions — run them only on machines you control. If you need higher assurance, request the skill author to provide documentation showing secure, non-plaintext handling of credentials (or to switch to recommending encrypted settings or environment-injected secrets).
Capability Analysis
Type: OpenClaw Skill
Name: maven-central-publish
Version: 1.0.0
The skill is designed for a legitimate purpose (publishing to Maven Central) and uses standard tools and configurations. However, it instructs the agent to store sensitive credentials (Maven Central user token, GPG passphrase) in `~/.m2/settings.xml` (as shown in `SKILL.md` and `templates/settings.xml`). While a common practice for Maven, this represents a significant security risk if the file is not properly secured. Additionally, the `SKILL.md` instructs the agent to execute `gpg --keyserver keyserver.ubuntu.com --send-keys <KEY_ID>`, which involves an outbound network connection to publish a GPG public key. These actions, while plausibly needed for the stated purpose, involve handling and transmitting sensitive information, classifying the skill as suspicious due to these high-risk capabilities without clear malicious intent.
Capability Assessment
Purpose & Capability
Name/description match the content: instructions, pom/templates, and advice all relate to publishing artifacts to Maven Central using GPG signing and the central-publishing plugin. Declared required binaries (maven, gpg) appear in a metadata block and the README references openjdk as well — all appropriate for the stated purpose.
Instruction Scope
SKILL.md stays on-topic (install maven/gnupg/openjdk, configure GPG loopback, populate ~/.m2/settings.xml, add plugins to pom, run mvn deploy). It does not instruct reading unrelated host files or exfiltrating data. However, it recommends storing sensitive credentials (user token and GPG passphrase) directly in ~/.m2/settings.xml which is a risky practice and should be avoided or replaced by secure alternatives.
Install Mechanism
This is an instruction-only skill with no install spec and no code files to execute — lowest install risk. The included apt-get snippets are examples (not automated installers) and reference common package sources. No downloads from untrusted external URLs are present.
Credentials
The skill requests no environment variables or external credentials in its metadata, which is proportionate. The instructions do, however, ask the user to place the Central Portal user token and the GPG passphrase in ~/.m2/settings.xml (plaintext). That is proportional to publishing but security-sensitive — storing secrets in plain files increases risk and better alternatives exist (Maven settings encryption, CI secret stores, gpg-agent, or prompting via secure pinentry).
Persistence & Privilege
Skill is not always-enabled, has normal user-invocable/autonomous settings, and does not request modification of other skills or system-wide agent settings. No privilege escalation or persistent background components are requested.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install maven-central-publish - After installation, invoke the skill by name or use
/maven-central-publish - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release: Provides a complete, modern workflow for publishing to Maven Central via the Central Portal.
- Step-by-step environment setup, including GPG loopback and Maven settings.
- Project requirements, plugin configuration, and recommended best practices for artifact publishing.
- Detailed deployment instructions with troubleshooting for common errors.
- Supports Java/Kotlin libraries using Maven and GPG signing.
Metadata
Frequently Asked Questions
What is maven-central-publish?
Provides a standardized Maven workflow to publish Java artifacts to Maven Central using GPG signing and the modern Central Portal plugin. It is an AI Agent Skill for Claude Code / OpenClaw, with 760 downloads so far.
How do I install maven-central-publish?
Run "/install maven-central-publish" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is maven-central-publish free?
Yes, maven-central-publish is completely free (open-source). You can download, install and use it at no cost.
Which platforms does maven-central-publish support?
maven-central-publish is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created maven-central-publish?
It is built and maintained by MISAKIGA (@misakiga); the current version is v1.0.0.
More Skills