SonarQube Scanner Skill
Pass
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and fetches project documentation from SonarSource's official GitHub repository.
- [COMMAND_EXECUTION]: The instructions describe the use of standard package managers and build tools, including yarn, npm, and gradle, to set up the environment.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data which represents a potential attack surface.
- Ingestion points: Fetches quality gate results and issue data from SonarQube Web API endpoints (
api/qualitygates/project_status,api/issues/search) as described inSKILL.md. - Boundary markers: None specified in the documentation.
- Capability inventory: Maps API findings to source code lines for inline review annotations.
- Sanitization: No explicit sanitization or filtering of API responses is documented.
Audit Metadata