sonarqube-review
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill facilitates legitimate code maintenance and quality improvement tasks. It leverages standard DevOps tools (Maven, npm, pytest, etc.) to automate the fixing of code smells, bugs, and vulnerabilities identified by SonarQube.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill handles SonarQube authentication tokens through environment variables. It includes specific security instructions for the agent to use these variables directly in commands without ever reading or displaying their contents, minimizing the risk of credential leakage.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external SonarQube APIs (issue descriptions and locations). This represents a functional attack surface; however, the risk is managed by the skill's structured approach to analyzing and fixing specific reported issues, and the behavior is essential to its primary purpose.
- [COMMAND_EXECUTION]: The skill executes various development commands (e.g., build, test, lint). These commands are restricted to isolated environments where applicable (using flags like -Dmaven.repo.local or --gradle-user-home) to prevent interference with the global system state.
Audit Metadata