sonar-analyze
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill uses established SonarSource tools (SonarQube MCP and Sonar CLI) to perform code analysis. External resource references follow the official vendor naming patterns ('sonarsource').
- [COMMAND_EXECUTION]: The skill utilizes limited shell commands (
git branch,docker ps,sonar analyze) to determine environment context and execute official analysis tools. These are scoped correctly in theallowed-toolsfrontmatter and do not involve arbitrary user input injection. - [REMOTE_CODE_EXECUTION]: While the skill can trigger the
sonar-integrateskill to install or update thesonarqube-cli, this is a controlled process from a trusted vendor and requires explicit user confirmation (yes/no) before proceeding. - [DATA_EXPOSURE]: The skill reads local files to send them to the SonarQube analysis engine. This is the primary intended purpose of the skill and is handled via restricted tool calls.
Audit Metadata