The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses the curl tool to communicate with the official SonarCloud API at sonarcloud.io. This is a well-known service and the interactions are consistent with the skill's documented purpose of fetching static analysis metrics.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data that could potentially contain malicious instructions. 1. Ingestion points: The agent retrieves issue messages, rule descriptions, and security hotspot details from the SonarCloud API. 2. Boundary markers: The instructions lack explicit delimiters or warnings to the agent to ignore instructions that might be embedded in the fetched API content. 3. Capability inventory: The skill has access to several tools including Bash, WebFetch, Read, Grep, and Glob. 4. Sanitization: No specific text validation or sanitization of the remote API data is performed before it is integrated into the agent's context.

sonarcloud-analysis