The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests issue reports in JSON format from external SonarQube instances to drive automated code fixes and command execution, creating a surface for indirect prompt injection if the external data source is untrusted or compromised.
Ingestion points: The script references/download-issues.sh downloads remote data into .sonar_devin_auto_fix/sonarqube_issues.json which is then used as the authoritative source for the agent's actions.
Boundary markers: No specific delimiters or instructions to ignore embedded commands within the JSON fields (like issue messages or rule descriptions) are provided.
Capability inventory: The skill possesses extensive capabilities including shell command execution via numerous build tools (mvn, gradle, npm, pip, dotnet, go, bundle, composer, sbt), file system write access for code modification, and network access via curl.
Sanitization: The instructions lack guidance on sanitizing or validating the content of the issues before the agent attempts to implement suggested fixes.
[EXTERNAL_DOWNLOADS]: The skill performs network operations and references external dependencies.
Remote Data: Fetches issue data from remote URLs using curl in references/download-issues.sh.
Missing Script: Both SKILL.md and references/sonar-local-scan.sh reference an external script ./install-skill-tools.sh for tool installation that is not included in the provided skill files, making its behavior unverifiable within this package.
[COMMAND_EXECUTION]: The skill executes a wide range of system commands and build tools to manage dependencies, run tests, and perform code linting and formatting across multiple stacks (Java, JavaScript, Python, C#, Go, Ruby, PHP, and Scala).

sonarqube-review