The Agent Skills Directory

[SAFE]: No malicious code or dangerous command execution patterns were detected. The skill logic focuses on interacting with SonarQube through authorized MCP tools.
[SAFE]: The skill resolves configuration from sonar-project.properties, which is a standard practice for project-specific tooling and does not expose sensitive credentials.
[SAFE]: Metadata Poisoning: The skill metadata claims the author is 'Anthropic Marketplace 3p' and uses 'official' tags, but the context provided indicates the actual author is 420company. This misleading attribution is deceptive.
[SAFE]: Indirect Prompt Injection Surface: The skill processes results from the external mcp__sonarqube__search_dependency_risks tool.
Ingestion points: Tool output in Step 4 (dependency risk results).
Boundary markers: None provided in the instructions for tool output.
Capability inventory: Limited to Read and Grep tools.
Sanitization: None, but risk is assessed as low as the agent only formats the data into a markdown table for display.

sonar-dependency-risks