sonar-integrate
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads installation scripts and tools from the official SonarSource GitHub repository. These include
install.shfor macOS/Linux andinstall.ps1for Windows, which are standard delivery methods for this vendor's CLI. - [COMMAND_EXECUTION]: The skill executes several local commands to manage the SonarQube integration, such as
sonar --version,sonar update,sonar auth status, and varioussonar integrate [agent]commands. It also checks for the presence of container runtimes usingdocker ps,podman ps, ornerdctl ps. - [REMOTE_CODE_EXECUTION]: The skill provides instructions to download and execute shell scripts directly from GitHub (e.g.,
curl ... | bashorirm ... | iex). While this is a high-privilege operation, it targets the official SonarSource repository and requires explicit user confirmation before execution.
Audit Metadata