sonar-fix-issue
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill's primary function is to identify and fix code quality issues. It uses the
ReadandEdittools exclusively for these tasks, which is consistent with its stated purpose. - [PROMPT_INJECTION]: The skill processes external data (source code and rule metadata) which represents a surface for indirect prompt injection. However, the instructions emphasize minimal changes and preserving behavior, which limits the impact of potential malicious instructions within the data.
- Ingestion points: User-provided file paths/contents (Step 3) and SonarQube rule descriptions via the
mcp__sonarqube__show_ruletool (Step 2). - Boundary markers: No explicit boundary markers or "ignore embedded instructions" warnings are defined for the ingested content.
- Capability inventory: The skill uses the
Edittool to modify source code on the local filesystem. - Sanitization: No specific sanitization or validation of the ingested code or rule metadata is performed.
Audit Metadata