The Agent Skills Directory

[SAFE]: The skill serves a defensive security purpose by guiding the agent to remediate SonarQube quality gate issues across Reliability, Security, and Maintainability dimensions. It provides explicit documentation for identifying and fixing vulnerabilities like SQL injection, XSS, and hardcoded secrets using standard secure alternatives (e.g., parameterized queries, sanitization libraries, and environment variables).
[INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection attack surface because it ingests and processes data from external SonarQube servers, which could theoretically be manipulated to include malicious instructions.
Ingestion points: Data is retrieved from SonarQube APIs regarding project issues, security hotspots, and quality metrics using discovered MCP tools (SKILL.md Step 4).
Boundary markers: The instructions do not define specific delimiters to isolate SonarQube-provided issue messages from the agent's logic, although the data is structured.
Capability inventory: The skill allows the agent to modify the local file system (applying fixes), execute arbitrary build/test commands defined in the project configuration (mvn, npm), and update the status of issues on the SonarQube server.
Sanitization: All code modifications are subject to validation using the project's build toolchain and a "Code Snippet Analysis" tool, which mitigates the risk of blindly following injected instructions.
[COMMAND_EXECUTION]: The skill instructs the agent to execute standard build and test commands (e.g., mvn compile, mvn test, npm run build, npm test) for validation purposes. These commands are necessary for the skill's primary function and are scoped to the target repository path provided in the invocation context.
[DYNAMIC_EXECUTION]: The reference documentation identifies dynamic code execution patterns (like eval() and new Function()) as security hotspots and provides instructions to replace them with safer alternatives such as lookup tables or sanitization (references/node/06-security-hotspots.md). The skill does not employ dynamic execution in its own remediation logic.

fix-sonar-issues