The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests external data from SonarQube servers using the references/download-issues.sh script. This data is subsequently processed to generate SPEC SDDs that drive automated code fixes. This creates a surface for indirect prompt injection where malicious or deceptive issue descriptions from a compromised or attacker-controlled SonarQube instance could influence the agent's behavior.
Ingestion points: The file .sonar_devin_auto_fix/sonarqube_issues.json acts as the primary ingestion point for external data.
Boundary markers: No explicit boundary markers or 'ignore embedded instructions' warnings are applied to the ingested JSON data.
Capability inventory: The skill possesses significant capabilities including file system writes, execution of various shell scripts, and the invocation of external build and test tools (mvn, npm, pip, etc.).
Sanitization: There is no evidence of sanitization or filtering of the SonarQube issue content before it is interpolated into SPEC templates.
[COMMAND_EXECUTION]: The skill executes a wide range of development and build tools across multiple stacks (Java, Node.js, Python, C#, Go, etc.) to validate and format code. This includes custom bash scripts such as references/detect-stack.sh and references/sonar-local-scan.sh that interact with the local environment and project files.
[DATA_EXFILTRATION]: The skill is designed to handle sensitive authentication tokens (e.g., SONARQUBE_CUSTOM_TOKEN, SONARQUBE_ENTERPRISE_TOKEN). While SKILL.md contains strict warnings against printing or inspecting these values, the references/download-issues.sh script transmits these tokens to a remote URL defined by the SONARQUBE_CUSTOM_URL environment variable. If this variable is pointed to an untrusted domain, it represents a standard exfiltration vector.

sonarqube-autofix