maven-central-publish

Provides a standardized Maven workflow to publish Java artifacts to Maven Central using GPG signing and the modern Central Portal plugin.

This skill appears to be exactly a Maven Central publish guide with matching templates — it is internally coherent. Before using it, avoid copying secrets verbatim into ~/.m2/settings.xml: do not store GPG passphrases or user tokens in plaintext. Prefer Maven settings encryption (settings-security.xml), CI secret storage, or using gpg-agent/loopback pinentry securely so the passphrase is not stored on disk. Review the templates and replace placeholder tokens with secret references managed by your CI or secret manager. Also be aware the example apt-get commands need root privileges and are just suggestions — run them only on machines you control. If you need higher assurance, request the skill author to provide documentation showing secure, non-plaintext handling of credentials (or to switch to recommending encrypted settings or environment-injected secrets).

Type: OpenClaw Skill Name: maven-central-publish Version: 1.0.0 The skill is designed for a legitimate purpose (publishing to Maven Central) and uses standard tools and configurations. However, it instructs the agent to store sensitive credentials (Maven Central user token, GPG passphrase) in `~/.m2/settings.xml` (as shown in `SKILL.md` and `templates/settings.xml`). While a common practice for Maven, this represents a significant security risk if the file is not properly secured. Additionally, the `SKILL.md` instructs the agent to execute `gpg --keyserver keyserver.ubuntu.com --send-keys <KEY_ID>`, which involves an outbound network connection to publish a GPG public key. These actions, while plausibly needed for the stated purpose, involve handling and transmitting sensitive information, classifying the skill as suspicious due to these high-risk capabilities without clear malicious intent.