sonar
Pass
Audited by Gen Agent Trust Hub on May 12, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill documents the use of the
af sonarCLI tool for read-only inspection of SonarQube instances. No malicious patterns, obfuscation, or unauthorized data access were detected. - [CREDENTIALS_UNSAFE]: The skill recommends using environment variables (
SONAR_TOKEN) and storing them in a.envfile. This is a standard and secure practice for local credential management; no hardcoded secrets or insecure handling of credentials were found. - [COMMAND_EXECUTION]: The provided commands (e.g.,
af sonar pr,af sonar gate) are specific to the tool's documented functionality. There is no evidence of arbitrary command execution or shell injection vulnerabilities. - [EXTERNAL_DOWNLOADS]: No external scripts, packages, or binaries are downloaded or executed by the instructions in the skill.
Audit Metadata