The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes issue reports downloaded from external SonarQube servers which contain data (issue messages, rule descriptions, code snippets) authored outside the repository. This represents an attack surface for indirect prompt injection. The skill mitigates this by including a mandatory 'Untrusted Input Handling' section that instructs the agent to treat external data strictly as non-executable text, extract only structured fields, and ignore any embedded directives.
Ingestion points: references/download-issues.sh fetches JSON data from the SonarQube API.
Boundary markers: The instructions provide explicit directives to quote suspicious content verbatim to the user instead of complying.
Capability inventory: The skill has extensive capabilities including file-writing (SPECs, tests) and subprocess execution of build tools (Maven, npm, pytest, etc.).
Sanitization: Instructions emphasize extracting only specific fields and treating the rest as descriptive evidence rather than instructions.
[COMMAND_EXECUTION]: The skill executes a wide array of development tools and shell scripts across multiple stacks. It runs stack-specific validation scripts (references/validate-*.sh) which invoke commands like mvn, npm, pytest, dotnet build, and sbt. While these are standard developer operations for fixing and validating code, they constitute a significant command execution capability within the agent's environment.
[EXTERNAL_DOWNLOADS]: Fetches project issue data from SonarQube API endpoints. The default configuration targets SonarCloud (sonarcloud.io), which is a well-known service. Authentication is handled via tokens stored in environment variables, following secure practices.
[CREDENTIALS_UNSAFE]: The skill manages several SonarQube authentication tokens. It demonstrates a safe security posture by explicitly instructing the agent never to read, print, or inspect the environment variables containing these secrets, using them only as direct arguments in shell commands.

sonarqube-autofix