Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/arvindand/agent-skillsnpx agentmods add skills/arvindand/agent-skills/maven-toolsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/arvindand/agent-skills/maven-tools)<a href="https://agentmods.dev/skills/arvindand/agent-skills/maven-tools"><img src="https://agentmods.dev/badge/skills/arvindand/agent-skills/maven-tools.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00115 | $0.02051 |
| Opus 5 | $0.00057 | $0.01026 |
| Sonnet 5 | $0.00023 | $0.00410 |
| Haiku 4.5 | $0.00012 | $0.00205 |
Grade A, and why
maven-tools scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 154 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Maven Tools
Use this skill to ground JVM dependency decisions in live Maven Central data.
This is an execution skill. Use Maven Tools MCP first for dependency facts, then do the reasoning in-model. Assume Maven Tools MCP is already configured; only discuss setup if the tools are unavailable.
When to Use
Activate when the user asks about:
- Java, Kotlin, Scala, or JVM dependencies
- Maven, Gradle,
pom.xml,build.gradle, orbuild.gradle.kts - latest versions, upgrades, CVEs, licenses, dependency age, or release history
- whether a dependency is safe, current, stale, or worth upgrading
Core Boundary
Use Maven Tools MCP for version, security, license, freshness, and release-pattern facts from Maven Central.
- Do the reasoning in-model: recommend next steps, call out risk, and separate safe-now actions from manual-review items.
- Normalize dependency inputs to
groupId:artifactIdorgroupId:artifactId:versionas needed. - For recommendation questions, evaluate concrete candidates with Maven Tools first, then add documentation context before making a strong call.
- Do not use Maven metadata alone to decide library popularity, framework fit, migration effort, or performance tradeoffs.
Tool Selection
Choose the narrowest tool that matches the request:
| Intent | Tool | Default Parameters |
|---|---|---|
| latest version lookup | get_latest_version |
stabilityFilter: PREFER_STABLE |
| check exact version | check_version_exists |
none |
| bulk candidate check (no current versions) | check_multiple_dependencies |
stabilityFilter: PREFER_STABLE |
| upgrade analysis (single coordinate, with current version) | compare_dependency_versions |
includeSecurityScan: true, stabilityFilter: STABLE_ONLY |
whole-POM upgrade plan (raw pom.xml) |
recommend_pom_upgrades |
mode: MINOR_PATCH |
resolve effective POM versions (raw pom.xml) |
analyze_pom_dependencies |
none |
| age/freshness | analyze_dependency_age |
use project-appropriate threshold |
| maintenance signal / release history | analyze_release_patterns |
monthsToAnalyze: 24 |
| full project audit | analyze_project_health |
includeSecurityScan: true, includeLicenseScan: true, stabilityFilter: PREFER_STABLE |
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 154 lines · 115 tokens per session scan A 2caefa3f5926
maven-tools is a skill published in the GitHub repository arvindand/agent-skills (16 stars, last pushed 11d ago), licensed MIT. It adds 115 tokens to every session and 2,051 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
spec-work
A workflow skill for completing todo items through written plans and progress records. It follows a sequence of writing a plan, getting approval, implementing the work, recording an update, and reporting completion.
spec-todo
A Korean-language skill for turning a project specification into requirements and a task list. Spec-Driven Development means planning the required behaviour before implementing it.
spec-init
A project setup skill for spec-driven development, a way of building software from written requirements before implementation. It creates a feature folder under ai-spec/projects with a requirement template and docs folder.
rework-rate
Measure and interpret PR rework rate — the emerging 5th DORA metric.
tokf-discover
Find missed token savings by scanning AI coding session files for commands that ran without tokf filtering.
skillnote
Self-hosted skill registry for OpenClaw. Stores procedures your team writes (name, description, body), syncs them to disk before each task, and collects which-helped/which-failed signals from the agent so the registry improves over time.