Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add decebals/claude-code-java --skill maven-dependency-auditgit clone --depth 1 https://github.com/decebals/claude-code-javaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/decebals/claude-code-java/maven-dependency-audit)<a href="https://agentmods.dev/skills/decebals/claude-code-java/maven-dependency-audit"><img src="https://agentmods.dev/badge/skills/decebals/claude-code-java/maven-dependency-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/decebals/claude-code-java/maven-dependency-audit"><img src="https://agentmods.dev/badge/skills/decebals/claude-code-java/maven-dependency-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00041 | $0.01827 |
| Opus 5.5 | $0.00016 | $0.00731 |
| Sonnet 5.5 | $0.00008 | $0.00365 |
| Haiku 4.5 | $0.00004 | $0.00183 |
Grade A, and why
maven-dependency-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 268 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Maven Dependency Audit Skill
Audit Maven dependencies for updates, vulnerabilities, and conflicts.
When to Use
- User says "check dependencies" / "audit dependencies" / "outdated dependencies"
- Before a release
- Regular maintenance (monthly recommended)
- After security advisory
Audit Workflow
- Check for updates - Find outdated dependencies
- Analyze tree - Find conflicts and duplicates
- Security scan - Check for vulnerabilities
- Report - Summary with prioritized actions
1. Check for Outdated Dependencies
Command
mvn versions:display-dependency-updates
Output Analysis
[INFO] The following dependencies in Dependencies have newer versions:
[INFO] org.slf4j:slf4j-api ......................... 1.7.36 -> 2.0.9
[INFO] com.fasterxml.jackson.core:jackson-databind . 2.14.0 -> 2.16.1
[INFO] org.junit.jupiter:junit-jupiter ............. 5.9.0 -> 5.10.1
Categorize Updates
| Category | Criteria | Action |
|---|---|---|
| Security | CVE fix in newer version | Update ASAP |
| Major | x.0.0 change | Review changelog, test thoroughly |
| Minor | x.y.0 change | Usually safe, test |
| Patch | x.y.z change | Safe, minimal testing |
Check Plugin Updates Too
mvn versions:display-plugin-updates
2. Analyze Dependency Tree
Full Tree
mvn dependency:tree
Filter for Specific Dependency
mvn dependency:tree -Dincludes=org.slf4j
Find Conflicts
Look for:
[INFO] +- com.example:module-a:jar:1.0:compile
[INFO] | \- org.slf4j:slf4j-api:jar:1.7.36:compile
[INFO] +- com.example:module-b:jar:1.0:compile
[INFO] | \- org.slf4j:slf4j-api:jar:2.0.9:compile (omitted for conflict)
Flags:
(omitted for conflict)- Version conflict resolved by Maven(omitted for duplicate)- Same version, no issue- Multiple versions of same library - Potential runtime issues
Analyze Unused Dependencies
mvn dependency:analyze
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 268 lines · 41 tokens per session scan A a2524d886f00
maven-dependency-audit is a skill published in the GitHub repository decebals/claude-code-java (754 stars, last pushed 1mo ago), licensed MIT. It adds 41 tokens to every session and 1,827 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
112-java-maven-plugins
Use when you need to add or configure Maven plugins in your pom.xml — including quality tools (enforcer, surefire, failsafe, jacoco, pitest, spotbugs, pmd), security scanning (OWASP), code formatting (Spotless), version management, container image build (Jib), build information tracking, and benchmarking (JMH) …
814-regulations-iso-25010
Use when reviewing, designing, or modifying Java enterprise systems and need a structured, repeatable ISO/IEC 25010:2023 quality-attribute review covering Functional Suitability, Performance Efficiency, Compatibility, Interaction Capability, Reliability, Security, Maintainability, Flexibility, and Safety, producing an…
121-java-object-oriented-design
Use when reviewing, improving, or refactoring Java object-oriented design, including applying SOLID, DRY, or YAGNI; improving classes and interfaces; correcting encapsulation, inheritance, or polymorphism; resolving God Class, Feature Envy, or Data Clumps; and improving object creation, methods, or exception…
110-java-maven-best-practices
Use when you need to review, improve, or troubleshoot a Maven pom.xml file — including dependency management with BOMs, plugin configuration, version centralization, multi-module project structure, build profiles, or any situation where you want to align your Maven setup with industry best practices. This should…
111-java-maven-dependencies
Use when you need to add or evaluate Maven dependencies that improve code quality or domain modeling — including nullness annotations (JSpecify), static analysis (Error Prone + NullAway), functional programming (VAVR), architecture testing (ArchUnit), or money and currency support (JavaMoney) — and want a…
114-java-maven-search
Routes Maven version questions to the right workflow by choosing project-local update report interpretation for a user’s own pom.xml, or Maven artifact discovery from maintainer-approved structured evidence. Use when interpreting dependency, plugin, or property update reports; finding Maven coordinates; verifying…