Propose a patch

A fix the maintainer can act on, with the evidence attached. It opens under your GitHub account in your browser; KillerSkills holds no token and never modifies the package. The fix is verified the only way we verify anything: the next crawl re-runs the new version in the honeypot. 70 · Caution

Evidence

The sandbox observed nothing beyond the static findings; the proposal cites those.

Diff · removes 11 caught lines

Download .patch

diff --git a/tests/test_gradle_resolve.py b/tests/test_gradle_resolve.py
--- a/tests/test_gradle_resolve.py
+++ b/tests/test_gradle_resolve.py
@@ -317,1 +317,0 @@
-"HTTPS_PROXY": "http://proxyuser:[email protected]:8080",
@@ -318,1 +317,0 @@
-"http_proxy": "http://otheruser:[email protected]:3128",
@@ -319,1 +317,0 @@
-"MAVEN_MCP_REPOSITORY_BASE": "https://repouser:[email protected]/repo",
@@ -354,1 +351,0 @@
-{"HTTPS_PROXY": "http://proxyuser:[email protected]:8080"},
diff --git a/AGENTS.md b/AGENTS.md
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -73,1 +73,0 @@
-5. Upload with `UV_PUBLISH_TOKEN` or a PyPI trusted publisher already registered for `kirich1409/maven-mcp`. The first upload of a project that does not exist yet needs an account-scoped token. Do not
@@ -189,1 +188,0 @@
-**Userinfo redaction.** Repo URLs are captured verbatim from build files (see *Documented limitations*), so a discouraged hardcoded `url = "https://user:pass@host/repo"` would otherwise echo the liter
diff --git a/tests/test_resolution.py b/tests/test_resolution.py
--- a/tests/test_resolution.py
+++ b/tests/test_resolution.py
@@ -757,1 +757,0 @@
-# A hardcoded `url = "https://user:pass@host/repo"` is a discouraged but real
@@ -763,1 +762,0 @@
-CREDENTIALED_URL = "https://repouser:[email protected]/m2"
@@ -875,1 +873,0 @@
-malformed = "https://user:pass@[::1"
@@ -889,1 +886,0 @@
-malformed = "https://user:pa@ss@[::1/path"
@@ -904,1 +900,0 @@
-# (https://user:pass@host) makes urlopen raise http.client.InvalidURL,

Zero-context hunks: apply with git apply --unidiff-zero fix.patch on the tagged source of 1.1.0. If the behavior is intended, declare it (host under permissions.network, a line in the README) instead of removing it; the next crawl scores declarations.

Issue / PR body

Title: maven-mcp: URL with embedded credentials (KillerSkills verdict caution 70)

## What the honeypot observed
KillerSkills ran **[email protected]** in an isolated sandbox (decoy credentials, recording proxy, syscall trace; engine 1.7) and scored it **CAUTION 70/100**. Summary: no network, touches nothing outside the project, writes no memory.

- See the findings below.

Full trace and findings: https://killerskills.ai/skills/pypi/maven-mcp/1.1.0

## Findings with a location
- `tests/test_gradle_resolve.py:319` · URL with embedded credentials — tests/test_gradle_resolve.py:319 · URL with embedded credentials — may be phishing or credential leaking
- `AGENTS.md:73` · Prompting user to enter sensitive credentials — AGENTS.md:73 · Prompting user to enter sensitive credentials — social engineering
- `tests/test_gradle_resolve.py:317` · URL with embedded credentials — tests/test_gradle_resolve.py:317 · URL with embedded credentials — may be phishing or credential leaking
- `tests/test_gradle_resolve.py:318` · URL with embedded credentials — tests/test_gradle_resolve.py:318 · URL with embedded credentials — may be phishing or credential leaking
- `AGENTS.md:189` · URL with embedded credentials — AGENTS.md:189 · URL with embedded credentials — may be phishing or credential leaking
- `tests/test_resolution.py:904` · URL with embedded credentials — tests/test_resolution.py:904 · URL with embedded credentials — may be phishing or credential leaking
- `tests/test_resolution.py:889` · URL with embedded credentials — tests/test_resolution.py:889 · URL with embedded credentials — may be phishing or credential leaking
- `tests/test_resolution.py:757` · URL with embedded credentials — tests/test_resolution.py:757 · URL with embedded credentials — may be phishing or credential leaking
- `tests/test_resolution.py:875` · URL with embedded credentials — tests/test_resolution.py:875 · URL with embedded credentials — may be phishing or credential leaking
- `tests/test_resolution.py:763` · URL with embedded credentials — tests/test_resolution.py:763 · URL with embedded credentials — may be phishing or credential leaking
- `tests/test_gradle_resolve.py:354` · URL with embedded credentials — tests/test_gradle_resolve.py:354 · URL with embedded credentials — may be phishing or credential leaking

## Proposed change
The attached patch removes the 11 lines above. If the behavior is intended, the fix is to declare it instead: list the host under `permissions.network` (or the MCP manifest) and say in the README why the package needs it; the next crawl will re-score it with the declaration taken into account.

## How this will be verified
Nothing is "verified safe" by assertion. When a new version is published, KillerSkills re-runs it in the honeypot and the verdict page updates; you can trigger it early from the verdict page ("Re-scan after I publish a fix"). Reply here or at [email protected] if you believe the verdict is wrong; disputes are reviewed by a person and the outcome is published on the verdict page.

_Proposed through killerskills.ai/threats by a user of the package, under their own GitHub account. The evidence is public; the package was never modified by KillerSkills._

Open the issue on GitHub (openai/codex)Fork to open a PR

# or from a terminal, under your own account:
gh repo fork openai/codex --clone && cd codex
curl -s https://killerskills.ai/skills/pypi/maven-mcp/1.1.0/patch.diff | git apply --unidiff-zero
git checkout -b killerskills/1.1.0 && git commit -am "maven-mcp: URL with embedded credentials"
gh pr create --fill --body-file <(curl -s https://killerskills.ai/skills/pypi/maven-mcp/1.1.0/patch.md)

We count proposals opened, not merged: a merge shows up as a new version that the crawl re-runs. Disputes: the maintainer can contest the verdict from its page; a person reviews it and the outcome is published.