The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands, including mvn verify sonar:sonar for Java projects and sonar-scanner (or npx sonar-scanner) for Node.js projects, which are necessary to perform code analysis.
[EXTERNAL_DOWNLOADS]: The skill includes a fallback mechanism to download the sonar-scanner utility via npx if it is not available locally. This behavior is documented as a last resort to maintain determinism and targets well-known package registries.
[CREDENTIALS_UNSAFE]: The skill requires a SONAR_TOKEN for authentication. It prevents credential exposure by instructing the user to provide it via environment variables rather than hardcoding it, and the execution script includes logic to mask the token in any generated output logs.
[INDIRECT_PROMPT_INJECTION]: The skill processes project configuration files such as pom.xml and package.json and reports build output. While these inputs are technically external, the skill handles them in a scoped manner dedicated to analysis.
Ingestion points: Reads pom.xml, package.json, and the standard output/error streams of the analysis tools.
Boundary markers: The instructions guide the agent to capture and report specific outcome signals (e.g., quality gate status) from the tool output.
Capability inventory: Uses standard system commands and build tools (mvn, npm/npx, shell execution) for the defined analysis task.
Sanitization: The skill relies on standard tool behavior for output and includes a specific masking routine for the authentication token.

execute-sonar-analysis